Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1549726
MD5:	6309770ca668239c93a093e885a362e2
SHA1:	e6b1bafe8723468b1c191f46d2c0a21d61e896e6
SHA256:	27c5187ed2c3272fadb508d182ca580e77161ed2699e53e39f151dc22cb89aef
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	35
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Creates multiple autostart registry keys

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

EXE planting / hijacking vulnerabilities found

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a global mouse hook

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

Setup.exe (PID: 1940 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 6309770CA668239C93A093E885A362E2)

chrome.exe (PID: 7884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa.1092c&nocache=20241105181325.34&_fcid=1730846226315208 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2176,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 8640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=4844,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5408 /prefetch:8 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 8660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5204,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5196 /prefetch:8 MD5: BB7C48CDDDE076E7EB44022520F40F77)

nsy2C04.tmp (PID: 8364 cmdline: "C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force MD5: 84EE733F8014D22DAD2DFEF725489980)

PcAppStore.exe (PID: 8752 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)

explorer.exe (PID: 5000 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

PcAppStore.exe (PID: 4920 cmdline: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)

tddPFIUbTNWNQ.exe (PID: 6648 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 6180 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 4888 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 2324 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 1488 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 3292 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 5304 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 3236 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 7656 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 2796 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 4168 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 2548 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 1244 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 6448 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 1928 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 4596 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 2772 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 2784 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 2768 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 5136 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 5256 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 4812 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 1352 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 4784 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 5776 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 4844 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 8100 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 3716 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 1688 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tddPFIUbTNWNQ.exe (PID: 6156 cmdline: "C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

Watchdog.exe (PID: 8820 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=00000000-0000-0000-0000-D05099DB2397 /rid=20241105181407.1816081953 /ver=fa.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)

svchost.exe (PID: 8472 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 8536 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc MD5: F586835082F632DC8D9404D83BC16316)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp, ProcessId: 8364, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc, CommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 908, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc, ProcessId: 8472, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	ReversingLabs: Detection: 41%
Source: C:\Users\user\PCAppStore\Uninstaller.exe	ReversingLabs: Detection: 29%
Source: C:\Users\user\PCAppStore\download\SetupEngine.exe	ReversingLabs: Detection: 18%

Machine Learning detection for sample

Source: Setup.exe

Joe Sandbox ML: detected

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exe	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	EXE: C:\Users\user\PCAppStore\download\SetupEngine.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\PcAppStore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\AutoUpdater.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\Uninstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\Watchdog.exe	Jump to behavior

Phishing

Source: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c	HTTP Parser: No favicon
Source: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid=	HTTP Parser: No favicon
Source: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid=	HTTP Parser: No favicon
Source: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid=	HTTP Parser: No favicon
Source: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid=	HTTP Parser: No favicon
Source: https://veryfast.io/installed.php?guid=00000000-0000-0000-0000-D05099DB2397&_fcid=	HTTP Parser: No favicon

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exe	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	EXE: C:\Users\user\PCAppStore\download\SetupEngine.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\PcAppStore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\AutoUpdater.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\Uninstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	EXE: C:\Users\user\PCAppStore\Watchdog.exe	Jump to behavior

Uses 32bit PE files

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir7884_1956877250			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_7884_509656711			Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore

Jump to behavior

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\ReadMe.txt			Jump to behavior

PE / OLE file has a valid certificate

Source: Setup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp, Watchdog.exe, 00000009.00000000.5078205769.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: tddPFIUbTNWNQ.exe, 0000000C.00000002.6490146345.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000000E.00000002.6484447698.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000000F.00000002.6487570102.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000010.00000002.6482233017.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000011.00000000.5148010650.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000012.00000000.5151662221.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000013.00000000.5154822157.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000014.00000000.5157002187.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000015.00000000.5161410807.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000016.00000000.5163919784.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000017.00000000.5165799904.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000018.00000002.6488709392.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000019.00000000.5172047362.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001A.00000002.6493456798.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001B.00000002.6486438363.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001C.00000002.6482929806.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001D.00000000.5184479193.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001E.00000000.5185943202.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000020.00000000.5192310077.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000021.00000002.6489002702.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000022.00000002.6487683792.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000023.00000000.5204704214.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000024.00000002.6492574469.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000025.00000002.6487306191.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000026.00000000.5211755599.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000027.00000000.5213333026.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000028.00000002.6485302926.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 000000
Source:	Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,	0_2_00406873
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	7_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_0040699E FindFirstFileW,FindClose,	7_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_0040290B FindFirstFileW,	7_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAA75F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,	8_2_00007FF64BAA75F8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAA76A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	8_2_00007FF64BAA76A8
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C616E0 FindClose,FindFirstFileExW,GetLastError,	9_2_00007FF733C616E0
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C70330 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF733C70330
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C61754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	9_2_00007FF733C61754

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 147.182.211.77 147.182.211.77
Source: Joe Sandbox View	IP Address: 161.35.127.181 161.35.127.181
Source: Joe Sandbox View	IP Address: 104.248.126.225 104.248.126.225
Source: Joe Sandbox View	IP Address: 9.9.9.9 9.9.9.9

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B93CB80 GetTickCount64,Sleep,GetTickCount,Sleep,URLDownloadToFileW,Sleep,DeleteFileW,

8_2_00007FF64B93CB80

Source: explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://Realtor.com
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe, 00000000.00000003.4651122535.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000003.5083107402.0000000000747000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5207123401.0000000000747000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6499776245.00000174A2803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Setup.exe, 00000000.00000003.4651122535.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000003.5083107402.0000000000747000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5207123401.0000000000747000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6488879245.00000174A0B72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 0000000A.00000000.5091419532.0000000009755000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlU
Source: PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pcapp.store/
Source: PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pcapp.store/9
Source: PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pcapp.store/B
Source: PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pcapp.store/j
Source: PcAppStore.exe, 00000008.00000003.6442147558.0000021A8D217000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pcapp.store/notify_app_v2.php?guid=00000000-0000-0000-0000-D05099DB2397&lastid=802&lasttime=1
Source: PcAppStore.exe, 00000008.00000003.6442147558.0000021A8D1EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pcapp.store:80/notify_app_v2.php?guid=00000000-0000-0000-0000-D05099DB2397&lastid=802&lasttim
Source: explorer.exe, 0000000A.00000002.6510752187.0000000009EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.5085583496.0000000003370000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000002.6512355018.000000000C310000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://veryfast.io/
Source: PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://veryfast.io/8S
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D1F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365385051.0000021A8D282000.00000004.00000020.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.certs/MicRooCerAut_2010-06-23.cr
Source: Setup.exe, 00000000.00000003.4651122535.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000003.5083107402.0000000000747000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5207123401.0000000000747000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6499776245.00000174A2803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: explorer.exe, 0000000A.00000000.5092564302.000000000996A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6520505451.000000000F512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5111467182.000000000F512000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 0000000A.00000000.5092564302.000000000996A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp)u=
Source: explorer.exe, 0000000A.00000000.5111467182.000000000F512000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApper
Source: explorer.exe, 0000000A.00000002.6509019068.0000000009938000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5092564302.0000000009938000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm3
Source: explorer.exe, 0000000A.00000000.5111467182.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6408819549.000000000F683000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000A.00000000.5111467182.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6408819549.000000000F683000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS6)
Source: explorer.exe, 0000000A.00000000.5091419532.0000000009735000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508052285.0000000009735000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000A.00000000.5091419532.0000000009735000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508052285.0000000009735000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/c
Source: explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/sports/blended?market=en-us&satoriid=fcf26e59-1c27-8bc8-206f-f8adb170f4a2&user=m
Source: explorer.exe, 0000000A.00000003.6407012970.000000000D363000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6404067678.000000000D4A9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6515256148.000000000D4AC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000A.00000000.5092564302.000000000996A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6509019068.000000000996A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?5
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=E36B60CB23FA4E5A968F6A0804F3FDF2&timeOut=5000&oc
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6514495395.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000A.00000000.5092564302.00000000099F6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6509019068.00000000099F6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coma
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/
Source: explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/c
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehwh2.png
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehwh2.svg
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/
Source: explorer.exe, 0000000A.00000002.6508052285.0000000009755000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5091419532.0000000009755000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240402.1/Weather/W36_Most
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/Weather/W33_Clea
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-dark
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gD5m
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gD5m-dark
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF7i
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF7i-dark
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=trCtrl$1
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ukCtrl$1
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=urCtrl$2
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=viCtrl$1
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreTRUOZRIWzNRUZuFnRfDSU92uFgFbJIzoe4XToBf0
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/
Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/6
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, Watchdog.exe, 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp, Watchdog.exe, 00000009.00000002.6488879245.00000174A0A9C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000000.5078205769.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/p.gif?guid=%ws&version=%ws&evt_src=watch_dog&evt_action=signal_
Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/p.gif?guid=00000000-0000-0000-0000-D05099DB2397&version=fa.1092
Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/y
Source: Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4781894379.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/
Source: Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta
Source: Setup.exe, 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092c&src=pc
Source: Setup.exe, 00000000.00000002.4783809134.0000000002C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: Setup.exe, 00000000.00000002.4781894379.000000000084A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c)
Source: Setup.exe, 00000000.00000002.4781894379.000000000084A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092cT
Source: Setup.exe, 00000000.00000002.4783809134.0000000002C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092ct
Source: Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/rome
Source: PcAppStore.exe, 00000008.00000003.6462139913.0000021A8D2AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.p
Source: PcAppStore.exe, 00000008.00000003.6462702694.0000021A8CFDC000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/73V
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/9
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/W
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/_&
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/ies
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/mesj
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6502464680.0000021A8A8DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/p.gif?guid=00000000-0000-0000-0000-D05099DB2397&version=fa.1092c&evt_src=fa_p
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/s
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/sz
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/tes
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ev.pcapp.store/tes2
Source: explorer.exe, 0000000A.00000000.5102133790.000000000D319000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D319000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.comlast_v=%ws&dl_lnk=%wsempty_instructionsno_internet_connectionend
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA18zgTq.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1ngK0C.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1rYdYW.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1rumdC.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1sK77d.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1tz21V.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1tz3Jx.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA36Tom.img
Source: explorer.exe, 0000000A.00000000.5091419532.0000000009784000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1nDkpC.img
Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: Setup.exe, 00000000.00000003.4651122535.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000003.5083107402.0000000000747000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5207123401.0000000000747000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6499776245.00000174A2803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: explorer.exe, 0000000A.00000000.5102133790.000000000D319000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D319000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 0000000A.00000000.5082921191.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comz
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.com
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comT
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/
Source: nsy2C04.tmp, 00000007.00000002.5211071511.0000000003AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/-
Source: Setup.exe, 00000000.00000002.4783809134.0000000002C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/-end-point:
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/?p=lpd_appstore-faq
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/O
Source: nsy2C04.tmp, 00000007.00000002.5211071511.0000000003AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/Windows
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/_
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/account/login
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/account/logintray_exitinvalid
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/cpg_fa.php?guid=An
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws
Source: PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws:Sunday:Mon:Monday:T
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/e/
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/e/G
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/fa_version.php?guid=%ws&end_v=%ws&nocache=%d
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/fa_version.php?guid=%ws&res=link&nocache=%d
Source: nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/inst_cpg.php?guid=&src=pcapp_full.
Source: Setup.exe, 00000000.00000002.4783809134.0000000002C50000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.4651122535.0000000002C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/inst_cpg.php?guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&ve
Source: nsy2C04.tmp, 00000007.00000002.5207123401.0000000000747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/inst_cpg.php?guid=00000000-0000-0000-0000-D05099DB2397&version=fa.1092c&src=pcap
Source: Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/installing.php?guid=&winver=
Source: Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/notify_app_v2.php?guid=&lastid=&lasttime=&nocache=&end_v=%ws%ws%ws%d%ws%d%ws%ws%
Source: PcAppStore.exe, 00000008.00000003.6462702694.0000021A8D009000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/notify_app_v2.php?guid=00000000-0000-0000-0000-D05099DB2397&lastid=802&lasttime=
Source: PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif
Source: Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4784086006.0000000002CFC000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.4779845715.0000000002CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?
Source: PcAppStore.exe	String found in binary or memory: https://pcapp.store/pixel.gif?guid=
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_&evt_action=&nocache=%s%s%s%s%s%s%s%s&%s%s%I
Source: nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_installer&evt_action=localmac
Source: Setup.exe, 00000000.00000003.4779545393.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=00000000-0000-0000-0000-D05099DB2397&version=
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=00000000-0000-0000-0000-D05099DB2397&version=fa.1092c&evt_src=fa_
Source: nsy2C04.tmp, 00000007.00000002.5211071511.0000000003A40000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5211071511.0000000003A96000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5211071511.0000000003A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=00000000-0000-0000-0000-D05099DB2397&version=fa.1092c&inst_parent
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/pixel.gifcurrent_path()
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.store/pixel.gifinvalid
Source: nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/privacy.html?guid=By
Source: Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min
Source: Setup.exe, 00000000.00000002.4783809134.0000000002C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/q
Source: Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/tos.html?guid=
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcappstore.s3.amazonaws.com/versionrinstruction_failed%ws?guid=%ws&nocache=%dauto_updater.ex
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 0000000A.00000000.5111467182.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6408819549.000000000F683000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEM
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod-streaming-video-msn-com.akamaized.net/v1/eus004/1e6c9709-e4c4-4692-80a9-9f6302e7053f/c3
Source: explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod-streaming-video-msn-com.akamaized.net/v1/eus004/86e79907-6fc4-4a38-baf6-17ed38b79139/36
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod-video-cms-amp-microsoft-com.akamaized.net/tenant/amp/entityid/AA1tyUCX?blobrefkey=close
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D19C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repcdn.veryfast.io/
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D19C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repcdn.veryfast.io/S$
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D19C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repcdn.veryfast.io/download/2.349/Setup.exe
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D19C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repcdn.veryfast.io/download/2.349/Setup.exeLocationETagAuthentication-InfoAgeAccept-RangesLa
Source: PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D18A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repcdn.veryfast.io/download/2.349/Setup.exeQ
Source: PcAppStore.exe	String found in binary or memory: https://search.pcapp.store/r.html?q=%ws&br=%ws&en=%ws&guid=%ws&end_v=%ws
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://search.pcapp.store/r.html?q=%ws&br=%ws&en=%ws&guid=%ws&end_v=%wsatlTraceGeneralatlTraceCOMat
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/lifestyle/truth-behind-5-unconventional-self-care-rituals-have-gone-viral-tiktok
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stacker.com/stories
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/
Source: PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/NS
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/download.php?guid=00000000-0000-0000-0000-D05099
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/download.php?guid=00000000-0000-0000-0000-D05099DB2397&version=last
Source: PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/j
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-us&chosenMarketReason=implicitNew
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-us&chosenMarketReason=implicitNew
Source: explorer.exe, 0000000A.00000000.5111467182.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6408819549.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5111467182.000000000F825000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 0000000A.00000000.5102133790.000000000D319000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D319000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comZ
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.businessinsider.com/real-estate-top-cities-home-prices-affordability-inventory-mortgage-
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.businessinsider.com/real-estate-us-housing-market-down-payments-mortgage-rates-realtor-2
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&r
Source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlYar&d
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/feed
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-butchers-how-to-choose-the-best-steak-they-
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/wellness/75-things-under-15-on-amazon-prime-that-are-legitimately-a
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/companies/bernie-marcus-the-home-depot-co-founder-and-billionaire-ph
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/retirement/5-big-social-security-changes-for-2025-how-many-will-impa
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/music/news/minneapolis-musician-tyka-nelson-prince-s-sister-and-only-full-
Source: explorer.exe, 0000000A.00000000.5091419532.0000000009700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508052285.0000000009706000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exit-polls-2024-fears-for-american-democracy-economic-discon
Source: explorer.exe, 0000000A.00000002.6508052285.0000000009784000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5091419532.0000000009784000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/jd-vance-spreads-outrageous-lie-about-haitian-immigrants/ar-
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/obama-urges-patience-with-election-results-it-takes-time-to-
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-vance-host-election-night-watch-party-in-palm-beach-fl
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/us-voters-cast-ballots-in-tight-race-as-turbulent-campaign-n
Source: explorer.exe, 0000000A.00000002.6508052285.0000000009706000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technolog
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/scientists-say-they-know-how-the-universe-will-end/ar-AA1s
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/after-188-years-the-world-s-longest-venomous-snake-is-officiall
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/israel-s-netanyahu-fires-defense-minister-gallant/ar-AA1tyHVG
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-war-latest-kyiv-confirms-first-battles-between-ukrainia
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/western-officials-suspect-russia-was-behind-a-plot-to-put-incen
Source: explorer.exe, 0000000A.00000000.5091419532.00000000097DB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6402308586.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508585869.00000000097DB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/play/games/cut-the-rope/cg-9npxcz4n8jw7
Source: explorer.exe, 0000000A.00000000.5091419532.0000000009700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508052285.0000000009706000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/play/games/fruit-chopper/cg-9n8wl40938mq
Source: explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/play/games/piece-of-cake/cg-9n5mln8fpwg8
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.oracle.com/technetwork/java/javase/downloads09Dg
Source: PcAppStore.exe, 00000008.00000003.6389453202.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6442147558.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.oracle.com/technetwork/java/javase/downloadsG

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056DE

Installs a global mouse hook

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Windows user hook set: 0 mouse low level C:\Users\user\PCAppStore\PcAppStore.exe

Jump to behavior

System Summary

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_00403640

Detected potential crypto function

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040755C	0_2_0040755C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406D85	0_2_00406D85
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_00406D5F	7_2_00406D5F
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAF1274	8_2_00007FF64BAF1274
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64B9295B0	8_2_00007FF64B9295B0
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACAC58	8_2_00007FF64BACAC58
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAF0BD8	8_2_00007FF64BAF0BD8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAE2B94	8_2_00007FF64BAE2B94
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACAA54	8_2_00007FF64BACAA54
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACB068	8_2_00007FF64BACB068
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAEF008	8_2_00007FF64BAEF008
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAE0F48	8_2_00007FF64BAE0F48
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64B900F20	8_2_00007FF64B900F20
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACAE64	8_2_00007FF64BACAE64
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACC3D8	8_2_00007FF64BACC3D8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACC75C	8_2_00007FF64BACC75C
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAE1A5C	8_2_00007FF64BAE1A5C
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACD984	8_2_00007FF64BACD984
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAE00EC	8_2_00007FF64BAE00EC
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACDD88	8_2_00007FF64BACDD88
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACB478	8_2_00007FF64BACB478
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAE13DC	8_2_00007FF64BAE13DC
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BACB274	8_2_00007FF64BACB274
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAA76A8	8_2_00007FF64BAA76A8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAD5560	8_2_00007FF64BAD5560
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C68CD0	9_2_00007FF733C68CD0
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C6E45C	9_2_00007FF733C6E45C
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C723C0	9_2_00007FF733C723C0
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C70330	9_2_00007FF733C70330
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C76AB8	9_2_00007FF733C76AB8
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C6D948	9_2_00007FF733C6D948
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C690E8	9_2_00007FF733C690E8
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C7285C	9_2_00007FF733C7285C
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C6C7C4	9_2_00007FF733C6C7C4
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C69F20	9_2_00007FF733C69F20
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C61754	9_2_00007FF733C61754
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C68EDC	9_2_00007FF733C68EDC
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C6DDDC	9_2_00007FF733C6DDDC
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C5ED50	9_2_00007FF733C5ED50

Found potential string decryption / allocating functions

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: String function: 00007FF64B8B11A0 appears 403 times
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: String function: 00007FF64B8B0F30 appears 88 times
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: String function: 00007FF64B8BFCC0 appears 57 times

PE file contains more sections than normal

Source: NW_store.exe.7.dr	Static PE information: Number of sections : 13 > 10
Source: nw.dll.7.dr	Static PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.7.dr	Static PE information: Number of sections : 12 > 10
Source: node.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.7.dr	Static PE information: Number of sections : 11 > 10
Source: nw_elf.dll.7.dr	Static PE information: Number of sections : 14 > 10
Source: libGLESv2.dll.7.dr	Static PE information: Number of sections : 12 > 10
Source: notification_helper.exe.7.dr	Static PE information: Number of sections : 13 > 10

Sample file is different than original file name gathered from version info

Source: Setup.exe, 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameinetc.dllF vs Setup.exe

Uses 32bit PE files

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal54.spyw.evad.winEXE@40/270@0/36

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B8B8790 GetLastError,FormatMessageW,

8_2_00007FF64B8B8790

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_00403640

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040498A

Source: C:\Users\user\PCAppStore\Watchdog.exe

Code function: 9_2_00007FF733C5DBA0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,CloseHandle,Process32NextW,CloseHandle,

9_2_00007FF733C5DBA0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B951860 FindResourceExW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,GetLastError,

8_2_00007FF64B951860

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\scoped_dir7884_1956877250

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

File created: C:\Users\user\PCAppStore

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsz155D.tmp

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'CREATE TEMP' \|\| substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' \|\| quote(s.name) \|\| ' WHERE ' \|\| group_concat(quote(s.name) \|\| '.' \|\| quote(f.[from]) \|\| '=?' \|\| fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' \|\| s.name \|\| ' USING COVERING INDEX(' \|\| group_concat('=?', ' AND ') \|\| ')', s.name \|\| '(' \|\| group_concat(f.[from], ', ') \|\| ')', f.[table] \|\| '(' \|\| group_concat(COALESCE(f.[to], p.[name])) \|\| ')', 'CREATE INDEX ' \|\| quote(s.name \|\|'_'\|\| group_concat(f.[from], '_')) \|\| ' ON ' \|\| quote(s.name) \|\| '(' \|\| group_concat(quote(f.[from]) \|\| fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') \|\| ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'CREATE TEMP' \|\| substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077211245.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5190145425.00007FF64BB52000.00000008.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201884745.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa.1092c&nocache=20241105181325.34&_fcid=1730846226315208
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2176,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=4844,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5408 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5204,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5196 /prefetch:8
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp "C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=00000000-0000-0000-0000-D05099DB2397 /rid=20241105181407.1816081953 /ver=fa.1092c
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa.1092c&nocache=20241105181325.34&_fcid=1730846226315208	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp "C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2176,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=4844,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5408 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5204,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5196 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=00000000-0000-0000-0000-D05099DB2397 /rid=20241105181407.1816081953 /ver=fa.1092c	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnrsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnrgidshandler.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: netutils.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: wldp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: wininet.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: profapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: schannel.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\explorer.exe	Section loaded: icu.dll
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll
Source: C:\Windows\explorer.exe	Section loaded: pcacli.dll
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll
Source: C:\Windows\explorer.exe	Section loaded: sfc_os.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\explorer.exe	Section loaded: dlnashext.dll
Source: C:\Windows\explorer.exe	Section loaded: wpdshext.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll
Source: C:\Windows\explorer.exe	Section loaded: storageusage.dll
Source: C:\Windows\explorer.exe	Section loaded: fhcfg.dll
Source: C:\Windows\explorer.exe	Section loaded: efsutil.dll
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.system.userprofile.dll
Source: C:\Windows\explorer.exe	Section loaded: cloudexperiencehostbroker.dll
Source: C:\Windows\explorer.exe	Section loaded: credui.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: wdscore.dll
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: secur32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	Section loaded: oleacc.dll

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: PC App Store.lnk.7.dr

LNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir7884_1956877250			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_7884_509656711			Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore

Jump to behavior

PE / OLE file has a valid certificate

Source: Setup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp, Watchdog.exe, 00000009.00000000.5078205769.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: tddPFIUbTNWNQ.exe, 0000000C.00000002.6490146345.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000000E.00000002.6484447698.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000000F.00000002.6487570102.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000010.00000002.6482233017.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000011.00000000.5148010650.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000012.00000000.5151662221.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000013.00000000.5154822157.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000014.00000000.5157002187.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000015.00000000.5161410807.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000016.00000000.5163919784.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000017.00000000.5165799904.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000018.00000002.6488709392.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000019.00000000.5172047362.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001A.00000002.6493456798.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001B.00000002.6486438363.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001C.00000002.6482929806.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001D.00000000.5184479193.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 0000001E.00000000.5185943202.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000020.00000000.5192310077.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000021.00000002.6489002702.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000022.00000002.6487683792.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000023.00000000.5204704214.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000024.00000002.6492574469.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000025.00000002.6487306191.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000026.00000000.5211755599.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000027.00000000.5213333026.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 00000028.00000002.6485302926.0000000000A7E000.00000002.00000001.01000000.00000019.sdmp, tddPFIUbTNWNQ.exe, 000000
Source:	Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B90BFE0 RoGetActivationFactory,LoadLibraryW,GetProcAddress,RoGetActivationFactory,LoadLibraryW,GetProcAddress,

8_2_00007FF64B90BFE0

PE file contains an invalid checksum

Source: Setup.exe	Static PE information: real checksum: 0x3937f should be: 0x3331d
Source: NW_store.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x23ab08
Source: Math.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x155a8
Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: System.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: vk_swiftshader.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x44caa7
Source: nsJSON.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x6718
Source: ffmpeg.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x1f8136
Source: inetc.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x13c41
Source: NSISFastLib.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x30512
Source: libEGL.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x7ddc6
Source: vulkan-1.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0xe0b14
Source: nw_elf.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x124d11
Source: NSISFastLib.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x30512
Source: libGLESv2.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x7b9652
Source: nsJSON.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x6718
Source: inetc.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x13c41
Source: notification_helper.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x11edb8
Source: nsDialogs.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2f9b

PE file contains sections with non-standard names

Source: NW_store.exe.7.dr	Static PE information: section name: .gxfg
Source: NW_store.exe.7.dr	Static PE information: section name: .retplne
Source: NW_store.exe.7.dr	Static PE information: section name: .voltbl
Source: NW_store.exe.7.dr	Static PE information: section name: CPADinfo
Source: NW_store.exe.7.dr	Static PE information: section name: _RDATA
Source: NW_store.exe.7.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll.7.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.7.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.7.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll.7.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.7.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.7.dr	Static PE information: section name: .retplne
Source: libEGL.dll.7.dr	Static PE information: section name: .voltbl
Source: libEGL.dll.7.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.7.dr	Static PE information: section name: malloc_h
Source: libGLESv2.dll.7.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.7.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.7.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.7.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.7.dr	Static PE information: section name: malloc_h
Source: node.dll.7.dr	Static PE information: section name: .gxfg
Source: node.dll.7.dr	Static PE information: section name: .retplne
Source: node.dll.7.dr	Static PE information: section name: .voltbl
Source: node.dll.7.dr	Static PE information: section name: _RDATA
Source: notification_helper.exe.7.dr	Static PE information: section name: .gxfg
Source: notification_helper.exe.7.dr	Static PE information: section name: .retplne
Source: notification_helper.exe.7.dr	Static PE information: section name: .voltbl
Source: notification_helper.exe.7.dr	Static PE information: section name: CPADinfo
Source: notification_helper.exe.7.dr	Static PE information: section name: _RDATA
Source: notification_helper.exe.7.dr	Static PE information: section name: malloc_h
Source: nw.dll.7.dr	Static PE information: section name: .gxfg
Source: nw.dll.7.dr	Static PE information: section name: .retplne
Source: nw.dll.7.dr	Static PE information: section name: .rodata
Source: nw.dll.7.dr	Static PE information: section name: .voltbl
Source: nw.dll.7.dr	Static PE information: section name: CPADinfo
Source: nw.dll.7.dr	Static PE information: section name: LZMADEC
Source: nw.dll.7.dr	Static PE information: section name: _RDATA
Source: nw.dll.7.dr	Static PE information: section name: malloc_h
Source: nw_elf.dll.7.dr	Static PE information: section name: .crthunk
Source: nw_elf.dll.7.dr	Static PE information: section name: .gxfg
Source: nw_elf.dll.7.dr	Static PE information: section name: .retplne
Source: nw_elf.dll.7.dr	Static PE information: section name: .voltbl
Source: nw_elf.dll.7.dr	Static PE information: section name: CPADinfo
Source: nw_elf.dll.7.dr	Static PE information: section name: _RDATA
Source: nw_elf.dll.7.dr	Static PE information: section name: malloc_h
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll.7.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.7.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.7.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.7.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll.7.dr	Static PE information: section name: _RDATA

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B90F0B0 pushfq ; ret

8_2_00007FF64B90F0B1

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\node.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\Math.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\Uninstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\nw_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exe	File created: C:\Users\user\PCAppStore\download\SetupEngine.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\PcAppStore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\nw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\AutoUpdater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\Watchdog.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll	Jump to dropped file

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	File created: C:\Users\user\PCAppStore\ReadMe.txt			Jump to behavior

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore	Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\PCAppStore\PcAppStore.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled ='TRUE'

Contains long sleeps (>= 3 min)

Source: C:\Users\user\PCAppStore\Watchdog.exe

Thread delayed: delay time: 300000

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Window / User API: threadDelayed 825	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Window / User API: threadDelayed 932	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Window / User API: threadDelayed 1686	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Window / User API: foregroundWindowGot 1135	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 634
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 637

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\Math.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Dropped PE file which has not been started: C:\Users\user\PCAppStore\download\SetupEngine.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsa5834.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Users\user\PCAppStore\Watchdog.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_9-16412

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 4808	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 8664	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 4808	Thread sleep time: -60000s >= -30000s

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select TotalPhysicalMemory from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select TotalPhysicalMemory from Win32_ComputerSystem
Source: C:\Users\user\PCAppStore\PcAppStore.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\PCAppStore\Watchdog.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,	0_2_00406873
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	7_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_0040699E FindFirstFileW,FindClose,	7_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	Code function: 7_2_0040290B FindFirstFileW,	7_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAA75F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,	8_2_00007FF64BAA75F8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAA76A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	8_2_00007FF64BAA76A8
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C616E0 FindClose,FindFirstFileExW,GetLastError,	9_2_00007FF733C616E0
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C70330 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF733C70330
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C61754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	9_2_00007FF733C61754

Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 60000

Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0AC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdWndClass
Source: PcAppStore.exe, 00000008.00000003.6390340838.0000021A8D25B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D308000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6462139913.0000021A8D308000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6442534687.0000021A8D25B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6390517535.0000021A8D25B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ruarMicrosoft Hyper-V Virtualization Infrastructure Driver
Source: PcAppStore.exe, 00000008.00000003.5236199995.0000021A8A883000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6502464680.0000021A8A878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Setup.exe, 00000000.00000003.4779913764.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783809134.0000000002C50000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5207123401.000000000071C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000003.5084105733.000000000071C000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5211071511.0000000003A40000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF58000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6502464680.0000021A8A82C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000002.6488879245.00000174A0B5F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6404067678.000000000D542000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6515256148.000000000D8B8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000003.00000002.6488762460.0000025092002000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D25B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6462376747.0000021A8D254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 67ruarMicrosoft Hyper-V Virtualization Infrastructure Driver
Source: nsy2C04.tmp, 00000007.00000002.5211071511.0000000003A40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: Watchdog.exe, 00000009.00000002.6488879245.00000174A0AC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: PcAppStore.exe, 0000001F.00000002.5199088323.000001BCBFF58000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000003.5196134252.000001BCBFF58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PnPSignedDriverMicrosoft Hyper-V Virtualization Infrastructure DriverSYSTEMROOT\VIDROOT\VID\0000{4d36e97d-e325-11ce-bfc1-08002be10318}\Device\00000003Microsoftwvid.infMicrosoft20060621000000.****+*Microsoft Hyper-V Virtualization Infrastructure Driver10.0.19041.1052Microsoft WindowsLMEMh

Source: C:\Users\user\Desktop\Setup.exe	API call chain: ExitProcess graph end node			graph_0-3503
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	API call chain: ExitProcess graph end node			graph_7-3481

Source: C:\Users\user\Desktop\Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64BAC8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00007FF64BAC8CB8

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64BAA1254 GetLastError,IsDebuggerPresent,OutputDebugStringW,

8_2_00007FF64BAA1254

Contains functionality to dynamically determine API calls

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B90BFE0 RoGetActivationFactory,LoadLibraryW,GetProcAddress,RoGetActivationFactory,LoadLibraryW,GetProcAddress,

8_2_00007FF64B90BFE0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B926690 GetProcessHeap,HeapFree,

8_2_00007FF64B926690

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAC8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF64BAC8CB8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: 8_2_00007FF64BAC3990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF64BAC3990
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C631C0 SetUnhandledExceptionFilter,	9_2_00007FF733C631C0
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C62FDC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF733C62FDC
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C67EA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF733C67EA8
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: 9_2_00007FF733C6255C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF733C6255C

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtCreateMutant: Direct from: 0x77D634EC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtMapViewOfSection: Direct from: 0x77D62C3C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtOpenSection: Direct from: 0x77D62D2C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtQueryValueKey: Direct from: 0x77D62B0C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtDeviceIoControlFile: Direct from: 0x77D62A0C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtQueryVolumeInformationFile: Direct from: 0x77D62E4C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtAllocateVirtualMemory: Direct from: 0x77D62B1C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtCreateFile: Direct from: 0x77D62F0C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtAddAtomEx: Direct from: 0x77D6304C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtOpenFile: Direct from: 0x77D62CEC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtOpenKeyEx: Direct from: 0x77D63BBC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtTerminateThread: Direct from: 0x77D62EEC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtOpenKeyEx: Direct from: 0x77D62ABC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtSetInformationThread: Direct from: 0x77D62DEC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtQueryInformationProcess: Direct from: 0x77D62B46
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtReadVirtualMemory: Direct from: 0x77D62DAC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtProtectVirtualMemory: Direct from: 0x77D62EBC
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtClose: Direct from: 0x77D62A8C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtQueryAttributesFile: Direct from: 0x77D62D8C
Source: C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe	NtSetInformationProcess: Direct from: 0x77D62B7C

Contains functionality to simulate keystroke presses

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64B935130 keybd_event,keybd_event,

8_2_00007FF64B935130

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa.1092c&nocache=20241105181325.34&_fcid=1730846226315208			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: unknown unknown			Jump to behavior

Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: C++/WinRT version:2.0.220110.5productr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnknfinityan.lnkindsnanproductshortcut_delete_erroreC=%XnfinityanindsnanShell_TrayWnd0p+00p+0unknowninfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)unknownLTRRTLLTRinfnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is type must be number, but is type must be number, but is \\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu%02X\/Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\PCAppStoreAppParamdefaultauto_start_oncontextual_offersperiodical_offerspersonilized_notifications%us%5B%5D=\uparamsnametype must be string, but is paramsnameurloidentryAppfilePath0e+000e+00RoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll^(https?://(?:www.)?([^/]+))(/.*)?$.dllDllGetActivationFactoryURL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableurloidlastTimeoTypesessionIdtagretmessageRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryiconnamepathoidanimationsoundmenu_storemenu_searchhttps://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_linkmicrosoftIdregpathkeyidwinGetParamsaltActionaltActionParamsid
Source: PcAppStore.exe, 00000008.00000003.5237700010.0000021A8D00D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndZ
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: productui_creation_failedcreation_error=%wsui_termination_errordirectory_switching_error.\nwjs\NW_store.exe.\ui\.ENDING_EVT_HANDLERWindows Default Lock ScreenLocalPCAppStore\productsystem_eventmsg=shutdownshutdownproductsystem_eventmsg=logofflogoff{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}ClosingEventproducttaskbar_handler_erroreCode=%luShell_TrayWndStartTrayDummySearchControlTrayButton
Source: PcAppStore.exe, PcAppStore.exe, 00000008.00000003.5235439919.0000021A8D009000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5235705714.0000021A8D00A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6498254653.0000000001620000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000002.6498254653.0000000001620000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.5084229581.0000000001621000.00000002.00000001.00040000.00000000.sdmp, tddPFIUbTNWNQ.exe, 0000000C.00000002.6496928334.0000000001390000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: list too longStartMenuExperienceHost.exeShellExperienceHost.exeexplorer.exeSearchApp.exeSearchUI.exeSearchHost.exe{"app":{"menu_search":{"search_request":"", "page":"a", "top":%d,"left":%d,"bottom":%d,"right":%d},"show_window": "menu_search"}}{"app": {"hide_window": "menu_search"}}Shell_TrayWndStartTrayDummySearchControlTrayButton
Source: explorer.exe, 0000000A.00000002.6487091486.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5082921191.0000000000F29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: explorer.exe, 0000000A.00000002.6498254653.0000000001620000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.5084229581.0000000001621000.00000002.00000001.00040000.00000000.sdmp, tddPFIUbTNWNQ.exe, 0000000C.00000002.6496928334.0000000001390000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000002.6498254653.0000000001620000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.5084229581.0000000001621000.00000002.00000001.00040000.00000000.sdmp, tddPFIUbTNWNQ.exe, 0000000C.00000002.6496928334.0000000001390000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 5Program ManagerjL
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: TTaskbarShell_TrayWnd{"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
Source: nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: NWidgetShell_TrayWndTrayNotifyWnd+TrayButtonPNGArial++

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\PCAppStore\Watchdog.exe

Code function: 9_2_00007FF733C767D0 cpuid

9_2_00007FF733C767D0

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: GetLocaleInfoEx,FormatMessageA,	8_2_00007FF64BAA68B0
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,	8_2_00007FF64B927BE0
Source: C:\Users\user\PCAppStore\Watchdog.exe	Code function: GetLocaleInfoEx,FormatMessageA,	9_2_00007FF733C61448

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Code function: 8_2_00007FF64BAA7B24 GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

8_2_00007FF64BAA7B24

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040352D

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\PCAppStore\PcAppStore.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Search Order Hijacking	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 DLL Search Order Hijacking	2 Obfuscated Files or Information	Security Account Manager	156 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	111 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 DLL Side-Loading	NTDS	361 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	1 DLL Search Order Hijacking	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	3 Masquerading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	111 Registry Run Keys / Startup Folder	241 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\nsa5834.tmp\Math.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsa5834.tmp\NSISFastLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsa5834.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsa5834.tmp\nsJSON.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsy2C04.tmp	42%	ReversingLabs	Win32.PUA.Generic
C:\Users\user\AppData\Local\Temp\nsz155E.tmp\NSISFastLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsz155E.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsDialogs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsJSON.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\AutoUpdater.exe	5%	ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe	8%	ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe	29%	ReversingLabs
C:\Users\user\PCAppStore\Watchdog.exe	5%	ReversingLabs
C:\Users\user\PCAppStore\download\SetupEngine.exe	18%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://powerpoint.office.comEM	0%	Avira URL Cloud	safe
https://repcdn.veryfast.io/	0%	Avira URL Cloud	safe
https://d74queuslupub.cloudfront.net/	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF7i	0%	Avira URL Cloud	safe
https://outlook.comz	0%	Avira URL Cloud	safe
https://d74queuslupub.cloudfront.net/6	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	0%	Avira URL Cloud	safe
https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta	0%	Avira URL Cloud	safe
https://repcdn.veryfast.io/download/2.349/Setup.exeLocationETagAuthentication-InfoAgeAccept-RangesLa	0%	Avira URL Cloud	safe
https://word.office.comZ	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF7i-dark	0%	Avira URL Cloud	safe
https://search.pcapp.store/r.html?q=%ws&br=%ws&en=%ws&guid=%ws&end_v=%wsatlTraceGeneralatlTraceCOMat	0%	Avira URL Cloud	safe
https://d74queuslupub.cloudfront.net/p.gif?guid=%ws&version=%ws&evt_src=watch_dog&evt_action=signal_	0%	Avira URL Cloud	safe
https://d74queuslupub.cloudfront.net/y	0%	Avira URL Cloud	safe
http://schemas.micro	0%	Avira URL Cloud	safe
https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092cT	0%	Avira URL Cloud	safe
https://delivery.pcapp.store/rome	0%	Avira URL Cloud	safe
https://passwords.google.comT	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm	0%	Avira URL Cloud	safe
https://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://veryfast.io/download.php?guid=00000000-0000-0000-0000-D05099DB2397&version=last	PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF7i	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/play/games/piece-of-cake/cg-9n5mln8fpwg8	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6098869	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6514495395.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D371000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/technology/scientists-say-they-know-how-the-universe-will-end/ar-AA1s	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ev.pcapp.store/W	PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.office.comZ	explorer.exe, 0000000A.00000000.5102133790.000000000D319000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6407012970.000000000D319000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.comz	explorer.exe, 0000000A.00000000.5082921191.0000000000F43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta	Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Realtor.com	explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comEM	explorer.exe, 0000000A.00000000.5111467182.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6408819549.000000000F683000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pcapp.store/j	PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=urCtrl$2	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://repcdn.veryfast.io/	PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D19C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ev.pcapp.store/s	PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_&evt_action=&nocache=%s%s%s%s%s%s%s%s&%s%s%I	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false		high
https://www.msn.com/en-us/news/world/after-188-years-the-world-s-longest-venomous-snake-is-officiall	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/health/wellness/75-things-under-15-on-amazon-prime-that-are-legitimately-a	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/	explorer.exe, 0000000A.00000000.5111467182.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000003.6408819549.000000000F683000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5111467182.000000000F825000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/20240908.1/Weather/W33_Clea	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://pcapp.store/tos.html?guid=	Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/odirm3	explorer.exe, 0000000A.00000002.6509019068.0000000009938000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5092564302.0000000009938000.00000004.00000001.00020000.00000000.sdmp	false		high
https://pcapp.store/fa_version.php?guid=%ws&end_v=%ws&nocache=%d	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pcapp.store/9	PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/pixel.gif?guid=	PcAppStore.exe	false		high
https://chrome.google.com/webstore	PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/israel-s-netanyahu-fires-defense-minister-gallant/ar-AA1tyHVG	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp)u=	explorer.exe, 0000000A.00000000.5092564302.000000000996A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://d74queuslupub.cloudfront.net/	Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcapp.store/notify_app_v2.php?guid=00000000-0000-0000-0000-D05099DB2397&lastid=802&lasttime=	PcAppStore.exe, 00000008.00000003.6462702694.0000021A8D009000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/notify_app_v2.php?guid=&lastid=&lasttime=&nocache=&end_v=%ws%ws%ws%d%ws%d%ws%ws%	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.html&	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/privacy/eula_text.htmlT&r	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/	PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://veryfast.io/NS	PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/pixel.gifinvalid	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false		high
https://www.msn.com/en-us/news/politics/6-things-to-watch-for-when-kamala-harris-debates-donald-trum	explorer.exe, 0000000A.00000000.5091419532.0000000009700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508052285.0000000009706000.00000004.00000001.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ev.pcapp.store/_&	PcAppStore.exe, 00000008.00000002.6504036049.0000021A8CF87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=ukCtrl$1	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ev.pcapp.store/9	PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 0000000A.00000000.5092564302.000000000996A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6520505451.000000000F512000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5111467182.000000000F512000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/a/answer/9122284	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, nsy2C04.tmp, 00000007.00000002.5208276942.000000000306C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://pcapp.store/B	PcAppStore.exe, 00000008.00000003.6442017436.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.6441607656.0000021A8D326000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/cpg_fa.php?guid=An	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false		high
https://www.msn.com/en-us/news/world/western-officials-suspect-russia-was-behind-a-plot-to-put-incen	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://d74queuslupub.cloudfront.net/6	Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min	Setup.exe, 00000000.00000002.4781894379.0000000000815000.00000004.00000020.00020000.00000000.sdmp	false		high
https://repcdn.veryfast.io/download/2.349/Setup.exeLocationETagAuthentication-InfoAgeAccept-RangesLa	PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D19C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF7i-dark	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.oracle.com/technetwork/java/javase/downloads09Dg	PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D216000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/music/news/minneapolis-musician-tyka-nelson-prince-s-sister-and-only-full-	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://veryfast.io/	PcAppStore.exe, 00000008.00000003.5366283526.0000021A8D1CD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000003.5365634838.0000021A8D1C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/feed	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 0000000A.00000002.6510752187.0000000009EE0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.5085583496.0000000003370000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000002.6512355018.000000000C310000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=zh-TWCtrl$1	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcapp.store/inst_cpg.php?guid=&src=pcapp_full.	nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ev.pcapp.store/sz	PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D1DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/privacy.html?guid=By	nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://policies.google.com/	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d74queuslupub.cloudfront.net/y	Watchdog.exe, 00000009.00000002.6488879245.00000174A0B0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcapp.store/fa_version.php?guid=%ws&res=link&nocache=%d	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002FDB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehwh2.svg	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/category/extensions	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://delivery.pcapp.store/rome	Setup.exe, 00000000.00000003.4779654464.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/exit-polls-2024-fears-for-american-democracy-economic-discon	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://passwords.google.comT	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-us&chosenMarketReason=implicitNew	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/us-voters-cast-ballots-in-tight-race-as-turbulent-campaign-n	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://search.pcapp.store/r.html?q=%ws&br=%ws&en=%ws&guid=%ws&end_v=%wsatlTraceGeneralatlTraceCOMat	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/retirement/5-big-social-security-changes-for-2025-how-many-will-impa	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://veryfast.io/download.php?guid=00000000-0000-0000-0000-D05099	PcAppStore.exe, 00000008.00000002.6504780086.0000021A8D136000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_installer&evt_action=localmac	nsy2C04.tmp, 00000007.00000002.5206602405.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws	nsy2C04.tmp, 00000007.00000002.5208276942.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, PcAppStore.exe, 00000008.00000000.5077075718.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000002.5201626989.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp, PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false		high
https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa	Setup.exe, 00000000.00000002.4783978741.0000000002C8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/foodanddrink/recipes/i-asked-3-butchers-how-to-choose-the-best-steak-they-	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/pixel.gif?guid=00000000-0000-0000-0000-D05099DB2397&version=fa.1092c&evt_src=fa_	PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D18A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stacker.com/stories	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://d74queuslupub.cloudfront.net/p.gif?guid=%ws&version=%ws&evt_src=watch_dog&evt_action=signal_	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, Watchdog.exe, 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp, Watchdog.exe, 00000009.00000002.6488879245.00000174A0A9C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000009.00000000.5078205769.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlYar&d	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/e/	PcAppStore.exe, 00000008.00000003.5366020883.0000021A8D181000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pcapp.store/pixel.gif	PcAppStore.exe, 0000001F.00000000.5189917193.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAehwh2.png	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=viCtrl$1	nsy2C04.tmp, 00000007.00000002.5208276942.00000000028F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/play/games/fruit-chopper/cg-9n8wl40938mq	explorer.exe, 0000000A.00000000.5091419532.0000000009700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6508052285.0000000009706000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=E36B60CB23FA4E5A968F6A0804F3FDF2&timeOut=5000&oc	explorer.exe, 0000000A.00000003.6403430762.000000000D8F9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.6518237173.000000000D8FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.5102133790.000000000D8B5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://pcapp.store/notify_app_v2.php?guid=00000000-0000-0000-0000-D05099DB2397&lastid=802&lasttime=1	PcAppStore.exe, 00000008.00000003.6442147558.0000021A8D217000.00000004.00000020.00020000.00000000.sdmp	false		high
https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092cT	Setup.exe, 00000000.00000002.4781894379.000000000084A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
31.13.71.36	unknown	Ireland	32934	FACEBOOKUS	false
216.239.34.181	unknown	United States	15169	GOOGLEUS	false
79.127.206.207	unknown	Czech Republic	9080	GINCzechRepublicEUCZ	false
142.251.40.131	unknown	United States	15169	GOOGLEUS	false
142.251.40.132	unknown	United States	15169	GOOGLEUS	false
142.251.40.195	unknown	United States	15169	GOOGLEUS	false
147.182.211.77	unknown	United States	27555	BV-PUBLIC-ASNUS	false
157.240.241.1	unknown	United States	32934	FACEBOOKUS	false
161.35.127.181	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
104.248.126.225	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
142.250.80.106	unknown	United States	15169	GOOGLEUS	false
9.9.9.9	unknown	United States	19281	QUAD9-AS-1US	false
142.250.80.104	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.251.179.84	unknown	United States	15169	GOOGLEUS	false
142.251.35.170	unknown	United States	15169	GOOGLEUS	false
142.250.176.196	unknown	United States	15169	GOOGLEUS	false
142.251.163.154	unknown	United States	15169	GOOGLEUS	false
18.164.116.25	unknown	United States	3	MIT-GATEWAYSUS	false
167.99.235.203	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
79.127.206.234	unknown	Czech Republic	9080	GINCzechRepublicEUCZ	false
79.127.206.235	unknown	Czech Republic	9080	GINCzechRepublicEUCZ	false
142.250.64.67	unknown	United States	15169	GOOGLEUS	false
142.251.40.100	unknown	United States	15169	GOOGLEUS	false
142.251.40.200	unknown	United States	15169	GOOGLEUS	false
64.227.17.224	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
31.13.71.7	unknown	Ireland	32934	FACEBOOKUS	false
79.127.206.208	unknown	Czech Republic	9080	GINCzechRepublicEUCZ	false
142.251.40.162	unknown	United States	15169	GOOGLEUS	false
142.250.65.200	unknown	United States	15169	GOOGLEUS	false
142.250.72.98	unknown	United States	15169	GOOGLEUS	false
142.251.35.162	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.11.20

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549726
Start date and time:	2024-11-06 00:11:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	31
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal54.spyw.evad.winEXE@40/270@0/36
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 170 Number of non-executed functions: 125
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
00:14:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
00:14:18	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
00:14:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=00000000-0000-0000-0000-D05099DB2397 /rid=20241105181407.1816081953 /ver=fa.1092c
00:14:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
00:14:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
00:14:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=00000000-0000-0000-0000-D05099DB2397 /rid=20241105181407.1816081953 /ver=fa.1092c
00:15:01	Task Scheduler	Run new task: fast_task path: C:\Program Files (x86)\Fast!\fast!.exe
18:15:44	API Interceptor	11618x Sleep call for process: PcAppStore.exe modified

LLM Input / Output

Input	Output
URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "We're on it, hold on", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Summoning the app genie", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "brands": [ "PC APP STORE" ] }
	```json { "brands": [ "PC APP STORE" ] }
URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: URL: https://pcapp.store
URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "brands": [ "PC APP STORE" ] }
	```json { "brands": [ "PC APP STORE" ] }
URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "brands": [ "PC APP STORE" ] }
	```json { "brands": [ "PC APP STORE" ] }
URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Installing Fast!, what's next?", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://pcapp.store/?p=lpd_installing_r2&guid=00000000-0000-0000-0000-D05099DB2397&_fcid=1730846226315208&_winver=19042&version=fa.1092c Model: claude-3-haiku-20240307	```json { "brands": [ "PC APP STORE" ] }
	```json { "brands": [ "PC APP STORE" ] }
URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Test drive Fast! - You will notice immediately how everything works faster and smoother, it's like having a new upgraded PC.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "brands": [ "Fast!" ] }
	```json { "brands": [ "Fast!" ] }
URL: https://veryfast.io/installed.php?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Fast! has been installed and will start shortly.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false } ``` The provided image appears to be a simple informational page about a software product called "Fast!". It does not contain any visible trigger text, input fields, PDF icons, CAPTCHAs, urgent language, or QR codes. The page seems to be focused on describing the features and benefits of the "Fast!" product, rather than prompting any specific user actions or accessing sensitive information.

URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "brands": [ "Fast!" ] }
	```json { "brands": [ "Fast!" ] }
URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "brands": [ "Fast!" ] }
	```json { "brands": [ "Fast!" ] }
URL: https://veryfast.io/installed.php?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "brands": [ "Fast!" ] }
	```json { "brands": [ "Fast!" ] }
URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Installing Fast!, what's next?", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://veryfast.io/installing2.html?guid=00000000-0000-0000-0000-D05099DB2397&_fcid= Model: claude-3-haiku-20240307	```json { "brands": [ "Fast!" ] }
	```json { "brands": [ "Fast!" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
9.9.9.9	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse
	http://assets.website-files.com/65e885e17261602dcdc10dce/663166d899226eaa1af23d4b_kilexi.pdf	Get hash	malicious	Unknown	Browse
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse
	https://agent.fleetdeck.io/RJhGzP5jyL7Wdj5mXz3b8B?win	Get hash	malicious	Unknown	Browse
	https://agentinstall.fleetdeck.io/fleetdeck-agent-WP1buGiXuuz5gPKfbD5LmX.exe	Get hash	malicious	Unknown	Browse
	AFFAIRE JUDICIAIRE MAILLARD.pdf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Trojan.CobaltStrike.4EYNH5.5772.17622.dll	Get hash	malicious	CobaltStrike	Browse
	https://storage.googleapis.com/edusa/algonquincollege.html#4cCRYb398kcWP32jndkfhfjyc4MIWDSMDNXLSZCFF1708863VSUP299741N9	Get hash	malicious	Phisher	Browse
	https://download.onelaunch.com/latest/Onelaunch%20Software.exe	Get hash	malicious	Unknown	Browse
147.182.211.77	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
161.35.127.181	SetupEngine.exe	Get hash	malicious	Unknown	Browse
	https://veryfast.io	Get hash	malicious	Unknown	Browse
	https://veryfast.io	Get hash	malicious	Unknown	Browse
	https://macdownload.informer.com/osx-fiery-master-installer/	Get hash	malicious	Unknown	Browse
	9c23f857-b0b9-47d6-b664-47a3132066f4.exe	Get hash	malicious	Unknown	Browse
	9c23f857-b0b9-47d6-b664-47a3132066f4.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
104.248.126.225	https://pcapp.store/pixel.gif	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_c30dd28cb119f2aa20ddabe8968b8cadbe80bcb2.zip	Get hash	malicious	Unknown	Browse
	nso7806.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	http://pcapp.store	Get hash	malicious	Unknown	Browse
	http://pcapp.store	Get hash	malicious	Unknown	Browse
	PcAppStore.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GINCzechRepublicEUCZ	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	79.127.205.103
	https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.html	Get hash	malicious	Unknown	Browse	79.127.227.46
	http://fortcollinsfineart.com/	Get hash	malicious	Unknown	Browse	79.127.216.66
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	79.127.222.216
	http://en-alldappfix.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	79.127.216.47
	https://solanadefimainnet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	79.127.227.46
	http://nodechain-launchpadlpx.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	79.127.227.46
	https://simplescalingdefender.pages.dev/	Get hash	malicious	Unknown	Browse	79.127.227.46
	http://rewardsforyoutoclaim.pages.dev/	Get hash	malicious	Unknown	Browse	79.127.216.47
DIGITALOCEAN-ASNUS	2va9zrsXLd.exe	Get hash	malicious	Remcos	Browse	206.189.218.238
	Eveshaw.pdf	Get hash	malicious	Unknown	Browse	159.65.213.219
	Mandatory 2FA Authenticator - Immediate Attention Required! October 18 2024 115452(UTC).msg	Get hash	malicious	Unknown	Browse	67.205.176.222
	https://www.google.com/url?q=https%3A%2F%2Fhm.ru%2FavuRpS&sa=D&sntz=1&usg=AOvVaw3TJv_p-78LeKmDlxZZNN5y	Get hash	malicious	Unknown	Browse	198.199.109.95
	https://zip-store.oss-ap-southeast-1.aliyuncs.com/updated%20file/paracms.txt	Get hash	malicious	Unknown	Browse	159.65.211.77
	Setup.exe	Get hash	malicious	Unknown	Browse	167.99.235.203
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	167.172.128.225
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	138.68.9.184
	Ponta Saheb. PO 4400049817.exe	Get hash	malicious	FormBook	Browse	167.172.133.32
DIGITALOCEAN-ASNUS	2va9zrsXLd.exe	Get hash	malicious	Remcos	Browse	206.189.218.238
	Eveshaw.pdf	Get hash	malicious	Unknown	Browse	159.65.213.219
	Mandatory 2FA Authenticator - Immediate Attention Required! October 18 2024 115452(UTC).msg	Get hash	malicious	Unknown	Browse	67.205.176.222
	https://www.google.com/url?q=https%3A%2F%2Fhm.ru%2FavuRpS&sa=D&sntz=1&usg=AOvVaw3TJv_p-78LeKmDlxZZNN5y	Get hash	malicious	Unknown	Browse	198.199.109.95
	https://zip-store.oss-ap-southeast-1.aliyuncs.com/updated%20file/paracms.txt	Get hash	malicious	Unknown	Browse	159.65.211.77
	Setup.exe	Get hash	malicious	Unknown	Browse	167.99.235.203
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	167.172.128.225
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	138.68.9.184
	Ponta Saheb. PO 4400049817.exe	Get hash	malicious	FormBook	Browse	167.172.133.32
BV-PUBLIC-ASNUS	https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0	Get hash	malicious	Unknown	Browse	147.182.200.48
	Setup.exe	Get hash	malicious	Unknown	Browse	147.182.211.77
	Setup.exe	Get hash	malicious	Unknown	Browse	147.182.211.77
	Setup.exe	Get hash	malicious	Unknown	Browse	147.182.211.77
	Setup.exe	Get hash	malicious	Unknown	Browse	147.182.211.77
	Setup.exe	Get hash	malicious	Unknown	Browse	147.182.211.77
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	147.182.236.130
	armv4l.elf	Get hash	malicious	Unknown	Browse	147.183.0.9
	1.exe	Get hash	malicious	Metasploit	Browse	147.182.192.25

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsa5834.tmp\Math.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	https://pcapp.store/pixel.gif	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	tKr6T60C1r.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003e.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	101576
Entropy (8bit):	4.025656042521211
Encrypted:	false
SSDEEP:	768:1lpOk7GzmvfZjk0O2ihviYiciohVM3NxL2qQq++X6fM1MYR1v4GUGSmoypg3wSlk:4kPo2ihviYiciohVMwinGRnKn+atWI
MD5:	B9BEAEB61952155A651049495D3C43D8
SHA1:	4D3B77719911B9AF643D47EEA181E82BABF7B1C9
SHA-256:	3F8D5A69D2564D778CC635CD403213F5E78420F96912DCD8D778937CB0AE4F50
SHA-512:	CEF3C89EBC258056FB37745643CA0CB5EAEBFAE35AEF436B435E2EF5637BF5AB03F5DD635C2E847B9B15FBC9E053304EC513A6366CBEF5DC88F0023A46FA85B5
Malicious:	false
Preview:	....h... .............P..............Q...0...Z...8..................O.......e.n.-.U.S.;.e.n.-.G.B...............X..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003f.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	104664
Entropy (8bit):	4.02824413140037
Encrypted:	false
SSDEEP:	1536:40kZvSEviYiciodAMuOAYqiEGbn0k+WvHxn:40kZvSEviYiciodDuOhqiek+WvRn
MD5:	186330B93EC4676580C95B8B77C87865
SHA1:	99A5DB1C6CA209952976FB3946720745EA174E58
SHA-256:	07545587EC2867545B4A78B6051A7990714B7AD8B8B77655B4450D0E5A122DE6
SHA-512:	5F2F6D68C378950B4CD744C495BDBAE9269AF466225E10FC870933EAF8B72F57700AFA3CCEB0793861E9E7B75DB51B68DAB3D6FF5D72AF20866B98C34FD1EFC3
Malicious:	false
Preview:	....h... .............P..............S.......]...8..................Q.......e.n.-.U.S.;.e.n.-.G.B...............X..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000040.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	103832
Entropy (8bit):	4.03300489557214
Encrypted:	false
SSDEEP:	768:zMlZxdIkHG0mmxA/jk0M0nviYicioIA3RNfLUhiq3QjNMp72jR1vslFPRmOypJ3G:z0IkZn0nviYicioIA3hiKGgnVy+Nw7
MD5:	EF6E2874789EC4DDF2D6F0EDD0471D6F
SHA1:	5F06513BB62F1F0DE95CC258C24BDA551C37441D
SHA-256:	C51C9B399791C87A30E18306CDFE4558D7BEB396D6963877F708A0A53B8BE243
SHA-512:	04940E6D0A5A5C444C0F4DA5E5674BB258FA6D530E985775F43296EE7928F22E9CA508B91FEDF41D3B2791CC04C1BC421C13FD8668B785AF552EEEA39F4F4405
Malicious:	false
Preview:	....h... ...............P...............S......]...................P...Q.......e.n.-.U.S.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\p[1].gif

Download File

Process:	C:\Users\user\PCAppStore\Watchdog.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\Math.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.024967061017882
Encrypted:	false
SSDEEP:	1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
MD5:	85428CF1F140E5023F4C9D179B704702
SHA1:	1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
SHA-256:	8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
SHA-512:	DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: tKr6T60C1r.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\NSISFastLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.334087823000165
Encrypted:	false
SSDEEP:	3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
MD5:	9C7A4D75F08D40AD6F5250DF6739C1B8
SHA1:	793749511C61B00A793D0AEA487E366256DD1B95
SHA-256:	6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
SHA-512:	E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........\|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\image.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	GIF image data, version 89a, 16 x 16
Category:	dropped
Size (bytes):	997
Entropy (8bit):	4.188896534234179
Encrypted:	false
SSDEEP:	12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
MD5:	1636218C14C357455B5C872982E2A047
SHA1:	21FBD1308AF7AD25352667583A8DC340B0847DBC
SHA-256:	9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
SHA-512:	837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
Malicious:	false
Preview:	GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........\|..U!f.\|....>u.M.........w>..+r...\|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n\|.CH...........+... .E.....d`.@......;

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	4.684597989866362
Encrypted:	false
SSDEEP:	384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
MD5:	A35CDC9CF1D17216C0AB8C5282488EAD
SHA1:	ED8E8091A924343AD8791D85E2733C14839F0D36
SHA-256:	A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
SHA-512:	0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\nsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.819708895488079
Encrypted:	false
SSDEEP:	384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
MD5:	F4D89D9A2A3E2F164AEA3E93864905C9
SHA1:	4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
SHA-256:	64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
SHA-512:	DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsl5824.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	318525781
Entropy (8bit):	6.931313706371873
Encrypted:	false
SSDEEP:	3145728:EEnqgvUBRlhK9QJiDS610scieJq1SXCSnsmdAGonTn:EEIKe0Djq7hCSkH
MD5:	1E82AC21A0AB4FB084013AC7F54B3647
SHA1:	152308A3F71C6CB7EADC4A6ECE3991E679CFC92F
SHA-256:	6A776340A1B9EC3E8094D3B46C247A3144F882D57AD976E6467407B8E09C3204
SHA-512:	A2F2C3C83F2FA83EEDBC3D70BF60E7DD16794B7DACD41FF2DA225034349ED2FDA070BA12F4E5E880A5B5FD81FA58B9C115B9A5812728575750704647654FDE89
Malicious:	false
Preview:	.7......,.......,.......D...=...........^6......\7..............................................................m...........................................................................................................................................................................3................2..................................................................................................................................j.......................k...................................................................................................................s..........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	93386616
Entropy (8bit):	7.99999306217129
Encrypted:	true
SSDEEP:	1572864:52KX1mfH5AoIZnp9/pkhKzHjrSADzxet6X3mRsDqpszbyxjpB3ayh1sN1KGoMy1u:5jExAJh/pksTnFet6mu2G0jptggJ+flP
MD5:	84EE733F8014D22DAD2DFEF725489980
SHA1:	950A437488464103B9BF34610962C22192585BFC
SHA-256:	F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
SHA-512:	132C9BE1217804B73F8A99EA44D702E9DA0782CB6BBCC80DB2C2C72BDA1A93D06B2ADEF1B464F9163311F7482B2400553BA082C0F7F3CCF3B42C8C9B881306EB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ............@.............................................HO.......... ..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\NSISFastLib.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.334087823000165
Encrypted:	false
SSDEEP:	3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
MD5:	9C7A4D75F08D40AD6F5250DF6739C1B8
SHA1:	793749511C61B00A793D0AEA487E366256DD1B95
SHA-256:	6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
SHA-512:	E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........\|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\image.gif

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	GIF image data, version 89a, 16 x 16
Category:	dropped
Size (bytes):	997
Entropy (8bit):	4.188896534234179
Encrypted:	false
SSDEEP:	12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
MD5:	1636218C14C357455B5C872982E2A047
SHA1:	21FBD1308AF7AD25352667583A8DC340B0847DBC
SHA-256:	9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
SHA-512:	837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
Malicious:	false
Preview:	GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........\|..U!f.\|....>u.M.........w>..+r...\|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n\|.CH...........+... .E.....d`.@......;

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	4.684597989866362
Encrypted:	false
SSDEEP:	384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
MD5:	A35CDC9CF1D17216C0AB8C5282488EAD
SHA1:	ED8E8091A924343AD8791D85E2733C14839F0D36
SHA-256:	A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
SHA-512:	0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.158136237602734
Encrypted:	false
SSDEEP:	96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5:	6C3F8C94D0727894D706940A8A980543
SHA1:	0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
SHA-256:	56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
SHA-512:	2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\nsJSON.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.819708895488079
Encrypted:	false
SSDEEP:	384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
MD5:	F4D89D9A2A3E2F164AEA3E93864905C9
SHA1:	4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
SHA-256:	64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
SHA-512:	DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\temp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Fri Oct 25 14:14:38 2024, mtime=Tue Nov 5 22:14:06 2024, atime=Fri Oct 25 14:14:38 2024, length=3116888, window=hide
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	3.4638748143419673
Encrypted:	false
SSDEEP:	24:8bmmvHbP1R/kY0AhR7BqwtkkN6iO/7ViJTvm:8bmo7P1tkqnlqON6iygTv
MD5:	A47AF9CDBF4447C19A3432B83A59DFF3
SHA1:	7C1780D894B056F9C32EB30EE1021F3E644F705C
SHA-256:	374259DF556C3A8CC18CA51199DC919B906DDADCD4C3E3F712BCA448B4CF31CD
SHA-512:	11A9C3DF7DE633198514C42428D40F7E49EE9C9C937BF0BF631754421C1E2C7956886640E73D2C03FE7E59D8F5909768706665AC36F8845ECEC383FEC4E7F288
Malicious:	false
Preview:	L..................F.@.. .....y..&...Y.i./....y..&..X./.....................0.:..DG..Yr?.D..U..k0.&...&........{.S...:..X./....i./......t...CFSF..1.....eY...PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F......eY..eY......X....................mki.P.C.A.p.p.S.t.o.r.e...D.j.2.X./.YY.y .PCAPPS~1.EXE..N......YY.yeY.....r.........................P.c.A.p.p.S.t.o.r.e...e.x.e.......X...............-.......W............E......C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.).C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico.........................................................................................................................................................................................................................

C:\Users\user\PCAppStore\AutoUpdater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	586584
Entropy (8bit):	6.337989770444409
Encrypted:	false
SSDEEP:	6144:BYnWgtbxN7L7kYcMB/cA4hxWbZKcXErHNkQLtZ9wNmCc0r93SFzd7FSAaxXDj5w:BYnWC7sQB/cA4nLrtkWemCn9YBUxXXy
MD5:	693221C78FDC00A0F87FB3D1381308D4
SHA1:	5ABD1481B0918A1815B542BFCB2EAD542C233DB8
SHA-256:	6BB4786AB76767D1F9B2E19FD1A20F2F76CF1BB96127FC26741F2BE609E7680D
SHA-512:	A58F0A1EA54ED94EDF3129088D89F2064F7D93ECD30F9590307963B287C8FF45580DC4D9A48F6D6C4AF72DB6E1E82EEF0EA3E4BF756B93B159C3CDE808041CFD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................f....f....f...............g.....gH.... ....g....Rich...........PE..d......g.........."....).....V.................@.....................................x....`.................................................P............G...P..PR......X)..........P...T.......................(.......@............................................text............................... ..`.rdata...m.......n..................@..@.data....<....... ..................@....pdata..PR...P...T... ..............@..@.rsrc....G.......H...t..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\PCAppStore\PcAppStore.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3116888
Entropy (8bit):	5.959240683924359
Encrypted:	false
SSDEEP:	24576:V9kabuTUmENsEyg1IgoPYbvE8C9BHv3QJTbiNG8g9MEiYQgsSryyH2mtJXKMCSd+:V5bGEXi8mPY9pMFxu7cnZN3
MD5:	4B88D8ADA8D22622C30D581FC38EAA52
SHA1:	0980A7B75DB94035A5DE1696210648ACB95ACEDE
SHA-256:	D4DE255AE1109391E4A4A967A8AD66DFB70FCCA7DB47777E40815F4E7B19F2A2
SHA-512:	0F87422498ED3C60ED21CDA492D038D10509E3B40E5E9D7614B6CB0EF903E241AD1BA9C2F67B43D9DA3980990735A5E0C325002E43E0A41CB12947E2DBECF19F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l4 O.ZsO.ZsO.Zs.uYrG.Zs.u_r..Zs_.^r\.ZsFu.sM.Zs_.YrC.Zs_._r$.Zs.u^rX.Zs.u\rN.Zs.u[rf.ZsO.[s..Zs..^rM.Zs.._r~.Zs...sN.ZsO..sN.Zs..XrN.ZsRichO.Zs........PE..d......g.........."....)..&..........+"........@.............................P0....../...`...................................................*......./.P^....-......f/.X)... 0..&..0").p....................$).(.... ).@.............&.H............................text.....&.......&................. ..`.rdata...`....&..b....&.............@..@.data...H.... +.......+.............@....pdata........-.......,.............@..@.rsrc...P^..../..`..................@..@.reloc...&... 0..(...>/.............@..B........................................................................................................................................................................................................................

C:\Users\user\PCAppStore\ReadMe.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.577360416859904
Encrypted:	false
SSDEEP:	3:TKPyFfliFRNAl2sIaRjyM1KOTxLELMZ4MKLJF8EelYq8AsXJVVWM4v:TyyFflmSssI+j1NLELM6MKn8EquZVVCv
MD5:	2845450EA9D938CFEA9809CA0C827F12
SHA1:	8DE2189530DA5923365436C37E4C55C500AC3FBF
SHA-256:	7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
SHA-512:	7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
Malicious:	false
Preview:	Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..

C:\Users\user\PCAppStore\Temp\tempPOSTData

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	5.165083330546471
Encrypted:	false
SSDEEP:	48:YZ1HdvZToD70MIZl0N1pR4s5oqY01vz6Zp8yEHJcFPai6+zmC2FEkM9S59AkW:oNdxfZl0rpR4s5oA1WZp8yCJcFPaiLzL
MD5:	C2FA9D87416E27FD33D15095A1568DEF
SHA1:	38B476C83C2195BEB02CE633A5A56DDDAC988693
SHA-256:	4452825472438CAA6BA5DC1E2907D963B5B67B831C916D071E3F255953EF19C7
SHA-512:	F37D6DE5343B67E60B57E68342E1AA722A09026F89025C58A295322DA6F1552161F810AC8D52725AD9AF58AE2941DBE72E49E794085205E0A697D3008D9F3982
Malicious:	false
Preview:	{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20230103113911%2E000000%2B060","os_processes":"197","os_architecture":"64-bit","os_virtmem":"33059700","os_mem":"16282484","cpu_name":"Intel%28R%29+Core%28TM%29+i9-9900K+CPU+%40+3%2E60GHz","cpu_maxclock":"3601","cpu_cores":"8","cpu_logicalproc":"16","pc_vendor":"To+Be+Filled+By+O%2EE%2EM%2E","pc_version":"To+Be+Filled+By+O%2EE%2EM%2E","gpu_name":"Intel%28R%29+UHD+Graphics+630","gpu_ram":"8336631808","gpu_bitsperpixel":"32","gpu_x":"1920","gpu_y":"1080","disk_name":"TS512GMTS430S","disk_size":"512105932800","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20200420000000%2E000000%2B000"},"pcapps":{"0":"Microsoft+Office+Home+and+Business+2019+-+en-us","1":"Mozilla+Firefox+%28x64+en-GB%29","2":"Mozilla+Maintenance+Service","3":"Windows+PC+Health+Check","4":"Microsoft+Update+Health+Tools","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component","7":"Upd

C:\Users\user\PCAppStore\Temp\tempPOSTResponse

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.089026662492467
Encrypted:	false
SSDEEP:	3:YGVE8fptxgDQLRv6zjQJNRvUXZ5:YGFRt9IoNaZ5
MD5:	3024A54E0C352ABE5EB5F753CA4828DA
SHA1:	DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
SHA-256:	3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
SHA-512:	D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
Malicious:	false
Preview:	{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}

C:\Users\user\PCAppStore\Uninstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	93880
Entropy (8bit):	6.891280387415397
Encrypted:	false
SSDEEP:	1536:2msAYBdTU9fEAIS2PEtu3rLFn22G9RowU49TV1Z43kUFInU73ALu:FfY/TU9fE9PEtubZrMtkkxUUi
MD5:	CD8B6F1BD281C288FB3F68925639B424
SHA1:	25EA108C45905418B8FDA2FCCF5ADA0EDE2710E5
SHA-256:	808FE10CBF09F21359E1D61860BFCDDE553F5CDA38723ECD0636FA25F652121D
SHA-512:	A05C60EA499BEA246FF0CB3308108862CDC56BC44A4E14F546FE8AF4C52172F73F5973EBA03FF1F2BB1C575C15BF62421034C02AFA703D093B986F95A999E1B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ......f.....@.............................................HO..........`E..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\PCAppStore\Watchdog.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	276312
Entropy (8bit):	6.155274238783893
Encrypted:	false
SSDEEP:	3072:JNh5y0IKTcOq1wpRsrIA/uuNT4KddgLA/exq10mMfnW9L/or6RMr4T+cnOMX4Hen:jyJKA5KKdWLA/GZhnWlV94+3H3
MD5:	11F3801CB9FF046D6075F681971C4EB8
SHA1:	91572872A265185E7F9793B50C5257B511707B36
SHA-256:	5BD22345C42FC1B7C89C281C9247BC81DBBDB4C8EF4DA76E2A9D86589D8CC118
SHA-512:	B7E1A5F391E112AAC0CFA8239AD5AE784161C8734C9A4F3EF386FF617915F7AC769A5DB790B66BD95E6DAB8BAABCC4E51DE31D614193CB69909DF393DC77A021
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P........................H............Q.......Q.......Q..................t....P.......P&.......N......P......Rich............................PE..d......g.........."....).............,.........@.............................p...........`.....................................................x........G.......1......X)...`.......O..p....................Q..(...PN..@............................................text............................... ..`.rdata..............................@..@.data....%...........\|..............@....pdata...1.......2..................@..@.rsrc....G.......H..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

C:\Users\user\PCAppStore\download\SetupEngine.exe

Download File

Process:	C:\Users\user\PCAppStore\PcAppStore.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	121016
Entropy (8bit):	7.2821762471192875
Encrypted:	false
SSDEEP:	3072:dbG7N2kDTHUpout88qf4LuPzy5n+dmEmGCKPUY:dbE/HUiFry5n+3QY
MD5:	85F2849F25944FC15E58521A52B800FF
SHA1:	718D11673DE4743835523983AB5E06F88785A03D
SHA-256:	C4942BAD2EAACA0BB5ED7E6900D6C85F12F0DB6DE790072838CE3F854B9AD677
SHA-512:	F5723F93695E84FC41F48F0153F024249E9ABC9FD03D788AF1C31D6084ACFBE4C85A76DE55AB8BE4F68D16807BC0381C269CC3834510D538E9710F528B04BEB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j..........-5............@..................................*....@.............................................XO..........H...p)...........................................................................................text....h.......j.................. ..`.rdata...............n..............@..@.data...............................@....ndata... ...`...........................rsrc...XO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\PCAppStore\nwjs\NW_store.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2312704
Entropy (8bit):	6.449649685576397
Encrypted:	false
SSDEEP:	49152:gg6wrmvfu6ZPfRFq8BcvDEzT3CuaMUgKS:H8Zn3Ci
MD5:	E472E46BDFD736351D4B086B4C4CA134
SHA1:	1AA886F0CB23B3D322A43BE797D411FCA84D82A7
SHA-256:	E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
SHA-512:	173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................

C:\Users\user\PCAppStore\nwjs\credits.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9560433
Entropy (8bit):	4.8475056659478915
Encrypted:	false
SSDEEP:	24576:/28lTEaiPJK0PJgVEv+F26vbV2f2EvYvAKMc/+uBPJ1PJLPJ1PJOPJDKspVosXxY:/2ETWgqSq+sIp2+qO1McdLRPiY2zXO
MD5:	7A32B7C762C76BD3EE38E3E998705899
SHA1:	E1C611A57115374A48CD84619BD06E43021B7352
SHA-256:	726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
SHA-512:	9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h

C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916712
Entropy (8bit):	6.398049523846958
Encrypted:	false
SSDEEP:	49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
MD5:	2191E768CC2E19009DAD20DC999135A3
SHA1:	F49A46BA0E954E657AAED1C9019A53D194272B6A
SHA-256:	7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
SHA-512:	5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Users\user\PCAppStore\nwjs\ffmpeg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2028032
Entropy (8bit):	6.64708834859118
Encrypted:	false
SSDEEP:	24576:x+QrVq8lxXjKAri3/8XLpvdZ4RAfdDY0K1w/cjWsdSJNTtMfxTCC:pdlNBfXt16RsFY0K3jWsdQVtM0C
MD5:	5FFF6F0423A38BFAF174CB670650F4F9
SHA1:	13ECD1C4784A5A178A998E9FC0DC08F556121712
SHA-256:	D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
SHA-512:	E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..\|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...\|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................

C:\Users\user\PCAppStore\nwjs\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:	196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\PCAppStore\nwjs\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	454144
Entropy (8bit):	6.3485070297294985
Encrypted:	false
SSDEEP:	6144:yLSe7mxAked1dLX9ValhL1IA9SbD/9PAE:yExAkedHLX9VC9OKE
MD5:	7255FCCD39F330CA2123F380B4967E0A
SHA1:	C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
SHA-256:	22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
SHA-512:	ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................

C:\Users\user\PCAppStore\nwjs\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8058880
Entropy (8bit):	6.448026576223661
Encrypted:	false
SSDEEP:	98304:XUoMnbHa6h5CmPt75W2+G15kI6a7Xm3rC:gDTCe4rt/aTCr
MD5:	6CD8726BEEFCFA69B48EAB1362A5CAD5
SHA1:	F4249179B86C0A870C55E6C5A263180C77017E81
SHA-256:	2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
SHA-512:	0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.\|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..\|.....{.......z.............@..B........................................................................................................................................

C:\Users\user\PCAppStore\nwjs\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	502905
Entropy (8bit):	5.409605383978337
Encrypted:	false
SSDEEP:	12288:Mqyim2uho5EnirXKhaG1B2+H2JynyaH4IFzZo0vgElgA2W0PSq+2ss30fzO75g6p:U2uhounkXyd1B2+H2JynyaH4IFzZo0ve
MD5:	8032CB8A1B40AC85ACBEAFD6514BE668
SHA1:	EE15C360BD913FFEC94E9E36224548CA83B2564C
SHA-256:	1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
SHA-512:	956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
Malicious:	false
Preview:	........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...\|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#

C:\Users\user\PCAppStore\nwjs\locales\af.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	813426
Entropy (8bit):	4.915984741122479
Encrypted:	false
SSDEEP:	12288:dTZog2ule8/xHT9KG3Sj+KRRz0l85X9icV03OzP+Xx30jH8+j:/ogg8/xpKGCj+KRRz085X9icV03OzP+W
MD5:	7B88BD642C86EC4D4FB9A5614D1DA63F
SHA1:	92CF23267B78039E2413F7F7F90E6636614A0C5C
SHA-256:	0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
SHA-512:	17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
Malicious:	false
Preview:	........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....)..............C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:

C:\Users\user\PCAppStore\nwjs\locales\am.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	822020
Entropy (8bit):	4.925237393732045
Encrypted:	false
SSDEEP:	6144:vFB3t9DiYK8a4HHFLrgOIPcd1CyWpQ5fuiDbmpQ:vn3t5SzU5fu+
MD5:	621B390B8AF0C70D682715323A92B61F
SHA1:	C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
SHA-256:	729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
SHA-512:	E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
Malicious:	false
Preview:	.........&g.e.....h.....i.....j....k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<

C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	897122
Entropy (8bit):	4.928723053414015
Encrypted:	false
SSDEEP:	12288:CIPFaBsPG/d/RXZwRq4fvPU7XUUk/K58N0j+JzIQ4pF:CIvAAC5h+c
MD5:	3C8E3C5B1D029E9A01943DDBA053C37F
SHA1:	785EE0C46B11A19C80770F2B310057E59D90C2E1
SHA-256:	98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
SHA-512:	DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
Malicious:	false
Preview:	.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d.........C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;

C:\Users\user\PCAppStore\nwjs\locales\ar.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	927865
Entropy (8bit):	4.686646990438899
Encrypted:	false
SSDEEP:	24576:4Tax7YKC3cquMMLYzzQkECPUwVbtbHp373ZL+3aAKHkVDYyKzumpod2nm5g0XuGq:W8C3cquMMLYUKUwVbtbHp373Zq3arkV8
MD5:	27C55B97D549BCF13145EC75F0A503CA
SHA1:	4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
SHA-256:	F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
SHA-512:	CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
Malicious:	false
Preview:	........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...\|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#....I.....*....\|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG

C:\Users\user\PCAppStore\nwjs\locales\bg.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1193463
Entropy (8bit):	4.299730648702171
Encrypted:	false
SSDEEP:	3072:o3d2APzZl1uPXdf826YBWviytaGHFGuzhr0Ylf14/QISydDbrK8VBbFKQg51lNDS:o3d3Fl18fPAtt1MFSydHrK8VBbG5llA
MD5:	7351AE61AE5884088AE68CE5BE0043D8
SHA1:	DBEEA5DA228F63A405548F0E6F82FBBB3D624058
SHA-256:	D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
SHA-512:	85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
Malicious:	false
Preview:	........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...\|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q................O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).........(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....\|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q

C:\Users\user\PCAppStore\nwjs\locales\bn.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	573774
Entropy (8bit):	5.391859865204477
Encrypted:	false
SSDEEP:	12288:gQQL7QREpAp973K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuCJkdz:hb9zaBRnvWDMN8UpOO5k/mVb
MD5:	F6E50323E0C5A657EBDC2FE7285C15F6
SHA1:	944356D207A7962A81801BB76B0E2C5226FF7F1E
SHA-256:	DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
SHA-512:	8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
Malicious:	false
Preview:	........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...\|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....\|&.....&.....'....='....P'.....'....((....h(.....(

C:\Users\user\PCAppStore\nwjs\locales\ca.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	583431
Entropy (8bit):	5.838398613999325
Encrypted:	false
SSDEEP:	12288:eV2UufpvPlAhTbe65aU8rwsiNOA3SzmPN:eV2UufpvNAhHh5aU8rvYOrzmPN
MD5:	7F1AD2897B210C4C25CFBDF0736F6809
SHA1:	62E0335A63BC9E2AE8A9826E08256B00E433D9F5
SHA-256:	E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
SHA-512:	C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
Malicious:	false
Preview:	.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n......................V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[................d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'

C:\Users\user\PCAppStore\nwjs\locales\cs.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	530651
Entropy (8bit):	5.44607278354406
Encrypted:	false
SSDEEP:	6144:QnPhyMLsqSAzVWgss5sbse814eBjtwlRDdJwL2obEXZaFRQ5gk2rp/b3d4nTGqF5:WDgxsJjiT55g/r2Tpj
MD5:	9D6A98D53208092F687AD7BB3DBAED7D
SHA1:	161D0689CA85147B356167F98EAD84783E331986
SHA-256:	04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
SHA-512:	B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
Malicious:	false
Preview:	........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&

C:\Users\user\PCAppStore\nwjs\locales\da.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	571551
Entropy (8bit):	5.489447532911186
Encrypted:	false
SSDEEP:	6144:if1WFbCgp1nHaxa03K7UpKD93g/ahmOC2GzV6wAXaOV5jbt5sRqJoUaM5QIBCAL:wQAgnp03K7Up4g/a01JE3t5yUfvBCAL
MD5:	851D55585CBC90143DD4C70EB4900574
SHA1:	DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
SHA-256:	DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
SHA-512:	B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................\|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).........................+....)+.....+....(,....`,

C:\Users\user\PCAppStore\nwjs\locales\de.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1016551
Entropy (8bit):	4.766567786580532
Encrypted:	false
SSDEEP:	24576:WStxYcxPdGgxh1hxFFiL9+YJXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egJ:TtxYcxPdGgxh1hxFFiL9+YJXDsSaSmqv
MD5:	F497F06BC0430F2FA1E2BFFC32E2B9C5
SHA1:	38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
SHA-256:	B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
SHA-512:	C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
Malicious:	false
Preview:	........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...\|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....\|%.....%.....&....m'.....'.....(.....(.....).....)...."..........+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....\|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN

C:\Users\user\PCAppStore\nwjs\locales\el.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	459985
Entropy (8bit):	5.5152848417450615
Encrypted:	false
SSDEEP:	6144:HAeAGZgSZ+XKFELrqmjLCd3MP9ej7HXfaYISMv5n5CSEBcWRnFc:HjfZgseoEL5C3Ma7H6N5CSgc
MD5:	F8EEEBF6B363D8578D769AA05FED5BA7
SHA1:	12E8B6FE48CA49936769B766A9A13510D9569A20
SHA-256:	1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
SHA-512:	3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
Malicious:	false
Preview:	.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................\|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....\|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................

C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	464664
Entropy (8bit):	5.505055040425703
Encrypted:	false
SSDEEP:	6144:V0BSJCCPeiISZuw3jcMP9eD3D9faYLbcNx5FSZngP/eXywB:8SJDPeDIjcMY3DzA5FSHywB
MD5:	4B6300C27E7575C32888C1F3364D5346
SHA1:	C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
SHA-256:	0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
SHA-512:	3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
Malicious:	false
Preview:	.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....\|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t

C:\Users\user\PCAppStore\nwjs\locales\en-US.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1031027
Entropy (8bit):	5.210875521790238
Encrypted:	false
SSDEEP:	24576:HmdiMRfFgJWHLboEFFRyYHiLNQTCvXTOnXv1x7S6a8wGi4ADjn1VtuYtP01+Z5zp:H/sm5z9v
MD5:	D5A14353A7FCC1F199F9234BD4551FF9
SHA1:	7476E2846B6C0D03338A074D7FE325BB468992FE
SHA-256:	E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
SHA-512:	BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
Malicious:	false
Preview:	.........&g.e.....h.....i.....j....k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....\|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N

C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	560321
Entropy (8bit):	5.366866302767652
Encrypted:	false
SSDEEP:	6144:jjxzJ7FnfONzx0T8puYnKwoR5g6qLFYUudBm+u:nP8/pQj5g64F4Tu
MD5:	AAB525A7681AE93791B283205064E2B4
SHA1:	A021DBDCD3F269B77D7133F47B63906FFF794F76
SHA-256:	5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
SHA-512:	841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
Malicious:	false
Preview:	........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v....w.7...y.=...z.L...\|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*

C:\Users\user\PCAppStore\nwjs\locales\es-419.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	559178
Entropy (8bit):	5.34611084339133
Encrypted:	false
SSDEEP:	6144:tMTZMKZuHswv12Jp/bNg86ip3+UxojFtnj45vzr700Iu96PZrk8jb:AZMKUGVVLpzojTnj45brY0sb
MD5:	078BD56804D26C26E9AA4F41BF6549F6
SHA1:	B1B575D34769F35CF28158BCB40C92264DECC551
SHA-256:	99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
SHA-512:	4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
Malicious:	false
Preview:	........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...\|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)

C:\Users\user\PCAppStore\nwjs\locales\es.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	509452
Entropy (8bit):	5.455817407928288
Encrypted:	false
SSDEEP:	6144:Z0izVKnUJ1HNRSUSx+DuM/Fb0WmFosQ4Eqsoh7Pwiw4dQH5ejnrlvCKMvaKWcEzn:vVKi7S65JmFosZtQH5ejJsW
MD5:	45E28E64378FABED845EB242A8F1563D
SHA1:	8FAA0651CA0D29596CA294DC448CB870D553C0FF
SHA-256:	68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
SHA-512:	3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
Malicious:	false
Preview:	........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...\|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&

C:\Users\user\PCAppStore\nwjs\locales\et.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	825360
Entropy (8bit):	5.0557125829631335
Encrypted:	false
SSDEEP:	24576:FqvG8u313uyqoT+s1qLpRmX1loT4RmdAQifaQ2XxFMJGk620dri1HMX9O9xdpxHk:Evpu55M
MD5:	A13029CB1D5873121E6BDD0929A6C772
SHA1:	7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
SHA-256:	2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
SHA-512:	AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
Malicious:	false
Preview:	.........%p.e.....h.....i.....j.....k....l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....\|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a......................................................................N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;

C:\Users\user\PCAppStore\nwjs\locales\fa.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	517467
Entropy (8bit):	5.424845538875905
Encrypted:	false
SSDEEP:	12288:RKUtqd19KJOKu4ar5HZ7kfCHEpyWaZ7WYM:Ntq8S5HFHAl
MD5:	E7B72F44D711DECE8E3043173A553AC4
SHA1:	892424E4E011AAC47B068F9FD929B5E41BCCA525
SHA-256:	5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
SHA-512:	A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....\|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."

C:\Users\user\PCAppStore\nwjs\locales\fi.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	584976
Entropy (8bit):	5.195604084490558
Encrypted:	false
SSDEEP:	6144:4ln56kcajNxYUC36tIQy7DQEuq2V8L0dnGNLmG5eXmi1YARFtK:KnAkcmqnxEG5omt
MD5:	F7F3CC17509AF03E639E983A091C2026
SHA1:	D36E61E50B5FA99BE2A3C3727AFEB142969C8308
SHA-256:	5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
SHA-512:	5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
Malicious:	false
Preview:	.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...\|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....\|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d..........*.....+....j+.....+.....+....",.....,.....,

C:\Users\user\PCAppStore\nwjs\locales\fil.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	606342
Entropy (8bit):	5.380118288987104
Encrypted:	false
SSDEEP:	12288:n2sEZLqUMDpDgEL6QuaMVWXKz05qlZQmZyMYnYtkL09ujzxRe5hxkJSW7v40wCJ/:zj2VIN5JL
MD5:	326917C8F37FE85E58AD3DE991D17A78
SHA1:	683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
SHA-256:	CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
SHA-512:	3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
Malicious:	false
Preview:	.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...\|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0..............................................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....\|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....)...............

C:\Users\user\PCAppStore\nwjs\locales\fr.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1177779
Entropy (8bit):	4.338116428198543
Encrypted:	false
SSDEEP:	3072:C3T12vbLPxCoYITYsRvc38ZUd02GHIwjAwREJKVMjNiT7llj63rhJXlPCKMi5eWt:dTbYITncQi02JCWJL5DAhc2T2
MD5:	D77AEE1AB6AF4FC83813A69D3CA61E46
SHA1:	C0786021AF8C8BBB083E9C4104B68BD28537893A
SHA-256:	5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
SHA-512:	78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
Malicious:	false
Preview:	........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...\|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................\|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?....a.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N

C:\Users\user\PCAppStore\nwjs\locales\gu.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	728589
Entropy (8bit):	4.658856122190603
Encrypted:	false
SSDEEP:	12288:W5SDjhr3FluYMy31frspm29Wqu/kQl4JACVXbfeQCajLn5l67co+oiNB05elmmdi:W5SdY5/oP
MD5:	04C846A7F65C1E95E49CFE69EC9EEB45
SHA1:	78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
SHA-256:	AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
SHA-512:	029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
Malicious:	false
Preview:	.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8................j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....)..........*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2

C:\Users\user\PCAppStore\nwjs\locales\he.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1250127
Entropy (8bit):	4.3103395858193565
Encrypted:	false
SSDEEP:	3072:AubcffOrA0yUdRSM7vyWYfbXpgTMoV/BB0ZV1d1AuxXRLiW3Jk1eTByntDPtDl+U:AuAf2E0yjUv3MlgTMJem05f5xhbv
MD5:	114BBD0D21C90DDFCE1D6E26432B7B9C
SHA1:	EBFC476B4D742D9FDF5D0E78996748497EB0B4FF
SHA-256:	E2321752811548A92EF069E53ABE349CAA93BE5596A2579DDE65391EE7CF915B
SHA-512:	6195FC185F8297CA1C38B79339F86F0788B342A90B0E98F1ED5883CBE61725000B1653E911EB749351BB74802B8E75199DCF0C95D903A4422755E809A6A1814D
Malicious:	false
Preview:	.........%_.e."...h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....\|.....}...........................................%.....,.....-...........0.....R.....w.....................................................g.............................8.....+.............................6.................~...........y.................+.............................8...........^..... .......................W.......................................... ..... .....!.....!....."....y#.....#.....#.....$....b%.....%.....%....s&.....'....M'....f'....=(.....(....b).....)....R*.....+....d+.....+....3,.....,....3-....O-.....-................./...../.....0.....0.....0.....2.....2.....3.....3....x4....#5....p5.....5....76.....6.....6.....7.....7....n8.....8.....9.....:.....:....A;.....;....O<.....<.....=....]=....Q>....-?.....?.....?.....@.....A....BB....zB.....C.....E.....E....+F....9G.....H.....H.....H.....J.....J....~K.....K.....L.....M.....M....:N....7O.....P.....P

C:\Users\user\PCAppStore\nwjs\locales\hi.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	562949
Entropy (8bit):	5.503469092776888
Encrypted:	false
SSDEEP:	3072:5pEDgLd6TlZ/9yZuYUapEXgaBV08L7SkK7D+wwWrDfB+uhAxqOSAq6+xMcwd0uPJ:HEDjTMzU0EV7xHwPBhbKBc5ag7yIjR/K
MD5:	54308E58D399D0F1C4E66A4A4B6E3B59
SHA1:	8DFCE74D45801654531C78E34CF6A6C2E4BA5556
SHA-256:	8141D126CD8ED7CD29B998E4A778E81AEC043BC126B5D2B0FB62F95C5FBF1F62
SHA-512:	33C74ACE0F430D2E7963512075007DCA70ADCDD43FCE31A27F925351CEB00CFECE329EC5E9B60DACFF7E28DA322FC9CEFF3FCD9AE3A7BB6655400F1A580C3EA2
Malicious:	false
Preview:	........F&..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....\|.....}.......................................................................................................C.................0.......................c...........#.....B.................R.....h...........".....T.....d.................2.....B.................G.....l...........i.................D.......................k...................................L.....g.............................e.......................C.............................U.....v.................I.......................D.....r.................L.......................A.....l.....\|...........'.....T.....d...........T.......................Z.....\|.................@....._.................(.....U.....l...........K.......................m.................. ....u ..... ..... ....G!.....!.....!.....".....".....#....t#.....#.....$....n$.....$.....$....9%.....%.....%.....%....'&....p&.....&.....&.....'....\|'.....'

C:\Users\user\PCAppStore\nwjs\locales\hr.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	605952
Entropy (8bit):	5.638270541961174
Encrypted:	false
SSDEEP:	6144:n0L6iTfLsgtbgq0LcP9wHs8DfcAujkatvV5RvBFZfpduYG3b7ZNIeHK9njDi59Rj:iTfrtcFQA0V5RvBn0zzKY5u0vv
MD5:	B7AA52653BBABCC713A03067E6FCFCC3
SHA1:	B18CC0B968C4C0F156E33F5C493E6C09760161DD
SHA-256:	244BE241E2FD68882ADB0C1A1C4AE93B1406AE22CCC14BCB37FC09FE3C2831A5
SHA-512:	CB393247F79F1A6CDD685AD9729D0C7FD3BFADB5591CD822A4F92BA19448E50C148517DC0DDC14C37243CC0145A5AB17D27C45CCEBDCCB76CEC70C1B444D07C0
Malicious:	false
Preview:	.........&L.e.H...h.L...i.]...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....W.....g.....}.................T...........u...................................f...........L.....f...........^.........................................(.......................{...........-.....^.............................s...........(.....:...........!.....c.....s...........v.................k...........W.....v...........j.........................................).......................q...........M.....d...........n.................>.................+.................W.....l...........r.................C...........(.....>..........." ....I ....e ..... ....0!....\!.....!.....!....L"....."....."....4#.....#.....#....&$.....$.....$.....$.....%.....%.....%.....&.....&.....&.....'....c'.....'.....(.....(....%)....4).....)....[..........*....s+.....+....:,....V,.....,....$-....U-....q-.....-....b.......

C:\Users\user\PCAppStore\nwjs\locales\hu.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	500354
Entropy (8bit):	5.374540321275158
Encrypted:	false
SSDEEP:	6144:HDTG/Veh932Bmcwf/yG+wFZf+MVnjHF3mmi8IxZ5GZhWwkK5cTSzo7IEji4JHw:HHG8h94sXyMFTVnjHFWmNIb5GZhow
MD5:	0EFA0011CE0365AE4AFC08753F559098
SHA1:	6AFC5115DFC222F0F2B2265A591B571803787DCA
SHA-256:	A780C4E8E48CBDF2064CFF3E9E025103739B3763E3B82DDD99C97DFFF8FB1CE2
SHA-512:	21C34901F5260606F14FE0E004851AF4DFA6960C28872417FB995ADAC4B2652609D9C0F5F30C0F76F4287217ADCDC0ACF1545CBD4E5A6F4B15565668840BCB75
Malicious:	false
Preview:	.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................@.......................`.......................Q.......................m.......................p.......................N.......................8.......................@.......................4............................._......................._.................!.......................(.....e.......................$.....I.....U.......................!.....\|.......................c.......................>.............................e.......................L.....~.................?.....u.......................(.....9.............................b.......................C.......................'.....c.....}.................=.....k.....z...........6.....r...................................Y.......................l.......................B ..... ..... ..... .....!....q!.....!

C:\Users\user\PCAppStore\nwjs\locales\id.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	558299
Entropy (8bit):	5.272942823509238
Encrypted:	false
SSDEEP:	6144:qrF11tFO6w7oWhI7xO2/IJ/jNLiISIqRRRsO1StiRT9TjexKqcQxLcaPpzHi9fLN:u1tFFehoXFZxR8g26sjoh59koF
MD5:	12FFE0FC0BE1B4134F219BD3B6D8F550
SHA1:	DC14159AEA6643FEED260C3E3EB9BF4286FFFD9C
SHA-256:	4FFAADC42BB0F78B78061EEC23B39BEBF34BA3B9B4F2CD0415FD3C94B2C828D3
SHA-512:	423EB3AA074617C8FB64EA909CF860C8706B73B5CBC97D85D21E9298DC53CF9451DECCB1DE45B19377E8E2461D78282D587264340BCE8F487AD48B0DDEE55123
Malicious:	false
Preview:	........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}.........................................................................................w.................X.................2.................'.................g.................(.....O.....].................$.....3.................L.....v...........n.................X.......................y.................".................?.....X...........R.................'.....s.......................W....................... .....G.....R.................\.....n.................J.....U................. .....).....x.......................Q.......................Z.................,.............................U.............................d.................(.......................c.......................>.....\|.................J ..... ..... .....!.....!..../"....."....."....<#.....#.....#.....$.....$.....%....W%....m%.....%.....%.....&..../&.....&.....&....:'

C:\Users\user\PCAppStore\nwjs\locales\it.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:	12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	677279
Entropy (8bit):	5.7261443457831875
Encrypted:	false
SSDEEP:	6144:5mNTLdjIcq5eHWv0WSGRBZ6Q2T+NbX5+Fo1Vi:5mNTxqe2ccBZ6Q2T+h5+FF
MD5:	A92DA679A63FB99BB5F3BCF829168D21
SHA1:	F15AA9BA6A952490DD881C82DED179FE03E50E80
SHA-256:	F78FEB7523A3B4C795AC02EB66FD455B0F490257549D681B7AA07255E99AB9D9
SHA-512:	3055528033206B6F32371A1BA05633614C0A3A9AF4FE2326FA3E6689BF535D5D540D926E08963FB668B02EEFF216DC2ECABED035C821C83E5D96CD2ED1531835
Malicious:	false
Preview:	........e%..e.....h.....i.....j.(...k.9...l.B...m.J...o._...p.l...q.r...v.~...w.....y.....z.....\|.....}.....................................................................................1.....O.....p...........+.................'.................Z.....r...................................\|.............................9.....K.................F.....V...........R.................@.................%.................8.....H...........#.....T.....c...........D.....{...........3...........5.....P.................6.....R...........S.................A............................d.................`...........2.....A...........=.......................}.................P.................1...........j.................j............ ....: ..... .....!....Q!....r!.....!....^"....."....."....f#.....#....$....d$.....$.....%....>%....M%.....%....R&.....&.....&....''.....'.....'.....'....z(.....).....).....)...............*.....+.....+....1,....w,.....,.....-.....-.....-.....-....k...........4/....O/

C:\Users\user\PCAppStore\nwjs\locales\ja.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1341496
Entropy (8bit):	4.250874916501427
Encrypted:	false
SSDEEP:
MD5:	F13C1631BB1E180C07CB10C5142CEC74
SHA1:	BD3B971893D3CE2206EDD040ED0EAB9BA010BD18
SHA-256:	3A63D9B5BDECE8442ACA6971771A660BCEAE995CA96394FA88B024FEF3C93BF7
SHA-512:	9122A55CE0E09ADAFE0162337B518228441D9A852E68761BFB62B656415F25386B3DB41279699F8035BE3BB3EA003FCBA91B5D5FC6EC538EF79E9486A488280A
Malicious:	false
Preview:	........M&..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....\|.....}.........................................................................(....._.................j.......................A.....I...........X.........................................]...........Y...........P...........q.....:.............................q...........2.....A...........y...........S...........".....1 .....!.....!.....!....)#....?$.....%....Q%.....&.....'.....(....@).....)....r..........*.....+....@,.....,.....,....U-.....-....>.....S.....6/...../....w0.....0.....1....?2.....2.....2.....3....B4.....4.....4.....5....p6.....6.....7.....7.....8.....9....@9....b:....a;....!<....P<....3=.....=....Q>.....>....>?.....?.....@....,@.....A.....A.....B....`B.....C....PD.....D....eE....MF.....F....RG.....G.....H.....I....'J....yJ.....K.....L....TM.....M....(O.....P.....Q.....Q....8S....6T.....T....lU.....V.....W..../X....\|X....IY.....Y....\Z.....Z.....[.....\....]]

C:\Users\user\PCAppStore\nwjs\locales\kn.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	569413
Entropy (8bit):	6.084713993678112
Encrypted:	false
SSDEEP:
MD5:	E8448C3D352C76C1C0F2B9F508852D9A
SHA1:	2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
SHA-256:	30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
SHA-512:	AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
Malicious:	false
Preview:	........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...\|.b...}.t.....\|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$

C:\Users\user\PCAppStore\nwjs\locales\ko.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	611429
Entropy (8bit):	5.6299671018290445
Encrypted:	false
SSDEEP:
MD5:	F6F5B593C91B7820C9552FFDDFAC03FC
SHA1:	D771AC14A49C7654043D0AE2DC52239BF4636F65
SHA-256:	FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
SHA-512:	45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
Malicious:	false
Preview:	........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).........!.........*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/

C:\Users\user\PCAppStore\nwjs\locales\lt.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	610750
Entropy (8bit):	5.626685122127425
Encrypted:	false
SSDEEP:
MD5:	8D8244CEA7D00E7502CFC62908147BB7
SHA1:	2ECF5C264208555EC5BD4530544CC0AEE99F558F
SHA-256:	C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
SHA-512:	B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
Malicious:	false
Preview:	........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....\|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r........................................z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....\|).....).....)....z.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/

C:\Users\user\PCAppStore\nwjs\locales\lv.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1394062
Entropy (8bit):	4.285571867304228
Encrypted:	false
SSDEEP:
MD5:	979090995F7F9DBFA9FA9A96349DA745
SHA1:	6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
SHA-256:	C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
SHA-512:	4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
Malicious:	false
Preview:	........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....\|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2..........+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a

C:\Users\user\PCAppStore\nwjs\locales\ml.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1147816
Entropy (8bit):	4.319695697825778
Encrypted:	false
SSDEEP:
MD5:	7862ABEC5008FAC0A8924B65B3058C05
SHA1:	BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
SHA-256:	44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
SHA-512:	C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
Malicious:	false
Preview:	.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).........E.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[

C:\Users\user\PCAppStore\nwjs\locales\mr.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	524044
Entropy (8bit):	5.251286724342732
Encrypted:	false
SSDEEP:
MD5:	5EE8AEFF66C42600D73F9CB7D8366CCE
SHA1:	DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
SHA-256:	A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
SHA-512:	96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
Malicious:	false
Preview:	........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....\|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$

C:\Users\user\PCAppStore\nwjs\locales\ms.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	508553
Entropy (8bit):	5.428763068409714
Encrypted:	false
SSDEEP:
MD5:	40B668B73BBF3575D009F3D528D388E5
SHA1:	E7186E4796216615F388C8A8058D898C4913F2FD
SHA-256:	8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
SHA-512:	8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
Malicious:	false
Preview:	........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...\|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....\|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'

C:\Users\user\PCAppStore\nwjs\locales\nb.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	525362
Entropy (8bit):	5.366124885898627
Encrypted:	false
SSDEEP:
MD5:	6E38F51EBC9B4AF616C984ACFEF7323E
SHA1:	1D871E09B051CDF1429FBB68FC43B7631DAD9438
SHA-256:	E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
SHA-512:	4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
Malicious:	false
Preview:	.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%

C:\Users\user\PCAppStore\nwjs\locales\nl.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	587942
Entropy (8bit):	5.759897632158159
Encrypted:	false
SSDEEP:
MD5:	2D6468A89698A05B8522F679825572D3
SHA1:	52EC81BC896051ED8A865B44C58F82EABA6B89B9
SHA-256:	477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
SHA-512:	59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
Malicious:	false
Preview:	......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...\|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....\|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'

C:\Users\user\PCAppStore\nwjs\locales\pl.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	551569
Entropy (8bit):	5.417670979179483
Encrypted:	false
SSDEEP:
MD5:	FBD585195E35E49C60A9190FBF815E86
SHA1:	F88FE564784D0441A304A4B126DE27FB2B0412EE
SHA-256:	ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
SHA-512:	22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
Malicious:	false
Preview:	........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...\|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(

C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	555353
Entropy (8bit):	5.392038775374042
Encrypted:	false
SSDEEP:
MD5:	C64146716C2A401FEC538E4C79785144
SHA1:	3C5D0B45225A39A65C0345E5C98A4E539D807FE1
SHA-256:	904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
SHA-512:	CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
Malicious:	false
Preview:	........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....\|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....\|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'

C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	574388
Entropy (8bit):	5.451836104471441
Encrypted:	false
SSDEEP:
MD5:	C613CAB2C2D6AC5B88E21FCB65671F19
SHA1:	291D545427FEAF8DA9DD75679ADA1BB70C66EB47
SHA-256:	8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
SHA-512:	1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
Malicious:	false
Preview:	.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...\|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....\|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'

C:\Users\user\PCAppStore\nwjs\locales\ro.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	941599
Entropy (8bit):	4.851052751447414
Encrypted:	false
SSDEEP:
MD5:	36D9CBBB31930EB5B78378EC63751BE6
SHA1:	5D123C38941CC4E59570254909291B29970F0CE1
SHA-256:	DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
SHA-512:	EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
Malicious:	false
Preview:	.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....\|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+..........*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;

C:\Users\user\PCAppStore\nwjs\locales\ru.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	592404
Entropy (8bit):	5.807054231111397
Encrypted:	false
SSDEEP:
MD5:	59822645439846B0A211C8566E7CF90E
SHA1:	F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
SHA-256:	60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
SHA-512:	E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
Malicious:	false
Preview:	........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...\|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................\|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....(....Y(....m(.....(.....)....>)....R).....)....I.....*

C:\Users\user\PCAppStore\nwjs\locales\sk.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	568760
Entropy (8bit):	5.4785168337779435
Encrypted:	false
SSDEEP:
MD5:	970F310ACBAFA4A29E0CFA5C979DF397
SHA1:	B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
SHA-256:	B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
SHA-512:	D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
Malicious:	false
Preview:	.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...\|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(

C:\Users\user\PCAppStore\nwjs\locales\sl.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	872667
Entropy (8bit):	4.788135484665425
Encrypted:	false
SSDEEP:
MD5:	5E439D9D281D90569CD4AA231FC8B287
SHA1:	AA8D4E28770F430DD7F93E2B9879748A97C74FB0
SHA-256:	9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
SHA-512:	C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
Malicious:	false
Preview:	........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@

C:\Users\user\PCAppStore\nwjs\locales\sr.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	512705
Entropy (8bit):	5.538975019723545
Encrypted:	false
SSDEEP:
MD5:	D31FED9E04F8915045F6A2CC7BD4C9FE
SHA1:	8C68186DC5463D4E45889E8DE021536110B09453
SHA-256:	931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
SHA-512:	3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
Malicious:	false
Preview:	.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.\|...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&

C:\Users\user\PCAppStore\nwjs\locales\sv.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	539452
Entropy (8bit):	5.338235032300934
Encrypted:	false
SSDEEP:
MD5:	F0314E8F5AF94C845AB4218468AF3454
SHA1:	4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
SHA-256:	0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
SHA-512:	11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
Malicious:	false
Preview:	........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...\|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....\|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['

C:\Users\user\PCAppStore\nwjs\locales\sw.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1387366
Entropy (8bit):	4.061553280377292
Encrypted:	false
SSDEEP:
MD5:	4411E4698E279FB95ADEA7BE9625F800
SHA1:	A3C655D334442CF5EF106B92F9778C9B3FBC252A
SHA-256:	BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
SHA-512:	4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
Malicious:	false
Preview:	.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z....\|.0...}.B.....J.....O.....W....._.....g.....n.....u.....\|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-.........~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k

C:\Users\user\PCAppStore\nwjs\locales\ta.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1281329
Entropy (8bit):	4.31693967998977
Encrypted:	false
SSDEEP:
MD5:	443D47F30632512C7E5A6E142D2A3CA3
SHA1:	98730D4194266544C204E11E30C1817A5C8DFAE6
SHA-256:	12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
SHA-512:	34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
Malicious:	false
Preview:	........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....\|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........\|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng

C:\Users\user\PCAppStore\nwjs\locales\te.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1076392
Entropy (8bit):	4.3678914271676845
Encrypted:	false
SSDEEP:
MD5:	ABFAD720A09628E229EE75C14DCC1DEE
SHA1:	80A075F9714D4C3BAFF06E1935B304558C3D597E
SHA-256:	0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
SHA-512:	D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
Malicious:	false
Preview:	........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....\|.....}...............................................................................).....S.............................................................................6.....u.................+.....\|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....\|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).........:.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK

C:\Users\user\PCAppStore\nwjs\locales\th.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	550618
Entropy (8bit):	5.609493488679069
Encrypted:	false
SSDEEP:
MD5:	CE85F55613C69479E13D011F0B81E3F1
SHA1:	07C31DF75DEECEC1BC09FFCD473B885EF0467B42
SHA-256:	EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
SHA-512:	3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
Malicious:	false
Preview:	........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....\|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....\|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(

C:\Users\user\PCAppStore\nwjs\locales\tr.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	938457
Entropy (8bit):	4.888192308730272
Encrypted:	false
SSDEEP:
MD5:	E72DBF8C00F7C211D1A220DB30EC7A7E
SHA1:	8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
SHA-256:	B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
SHA-512:	D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
Malicious:	false
Preview:	.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....\|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q..............+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?

C:\Users\user\PCAppStore\nwjs\locales\uk.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	817673
Entropy (8bit):	5.177156515939135
Encrypted:	false
SSDEEP:
MD5:	3129155651C81F86E5E2794B0CD15EC7
SHA1:	FB3D6C2156E1230C099B02171F3E9100FBE542A8
SHA-256:	67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
SHA-512:	31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
Malicious:	false
Preview:	........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...\|.U...}.g.....o.....t.....\|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....\|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... .....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<

C:\Users\user\PCAppStore\nwjs\locales\ur.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	651358
Entropy (8bit):	5.790776889845594
Encrypted:	false
SSDEEP:
MD5:	5910DEDFBC84629690DD59478E80B51A
SHA1:	AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
SHA-256:	0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
SHA-512:	1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
Malicious:	false
Preview:	.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................&.....7.....`...........7...........U.....q....................................................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....].....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....\|1

C:\Users\user\PCAppStore\nwjs\locales\vi.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	472125
Entropy (8bit):	6.686635546459109
Encrypted:	false
SSDEEP:
MD5:	79D8DDFE89B3B2B37BBBF85AFD6E6D67
SHA1:	0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
SHA-256:	ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
SHA-512:	5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
Malicious:	false
Preview:	.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...\|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................\|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!

C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	469061
Entropy (8bit):	6.698957808032297
Encrypted:	false
SSDEEP:
MD5:	687995F645CB9169DBFC3431E8FCFE3B
SHA1:	D6931394363D7C479791B32C8AD268786FFCE8AF
SHA-256:	35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
SHA-512:	FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
Malicious:	false
Preview:	.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z

C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak.info

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	CSV text
Category:	dropped
Size (bytes):	1051021
Entropy (8bit):	5.4211132061857965
Encrypted:	false
SSDEEP:
MD5:	82D7AB0FF6C34DB264FD6778818F42B1
SHA1:	EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
SHA-256:	E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
SHA-512:	176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
Malicious:	false
Preview:	IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

C:\Users\user\PCAppStore\nwjs\node.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18401792
Entropy (8bit):	6.484724602010289
Encrypted:	false
SSDEEP:
MD5:	6A067CB26AF2C240C240BC81C4A4F311
SHA1:	CFB1A89616DC14830EB073F4CD84AC4EB14B4534
SHA-256:	C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
SHA-512:	25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..\|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................

C:\Users\user\PCAppStore\nwjs\notification_helper.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1162240
Entropy (8bit):	6.551791881008996
Encrypted:	false
SSDEEP:
MD5:	EDF83410995BEA188731EF377334ED7B
SHA1:	B12C8925409701725749A9EBCC9D6CBFDB0122DD
SHA-256:	B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
SHA-512:	A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................

C:\Users\user\PCAppStore\nwjs\nw.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	196713984
Entropy (8bit):	6.709853681888895
Encrypted:	false
SSDEEP:
MD5:	0B9A2D445F28B403D525380817A2636E
SHA1:	E4BECC1533A42871BA87A06D039D3477ABE4F79A
SHA-256:	264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
SHA-512:	45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.\|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................

C:\Users\user\PCAppStore\nwjs\nw_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	685745
Entropy (8bit):	7.962986984739525
Encrypted:	false
SSDEEP:
MD5:	9B46F4C8DFC0A55BFAFAC55F17D7659B
SHA1:	D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
SHA-256:	B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
SHA-512:	DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
Malicious:	false
Preview:	..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...\|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@....@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<

C:\Users\user\PCAppStore\nwjs\nw_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	1079219
Entropy (8bit):	7.95049008504143
Encrypted:	false
SSDEEP:
MD5:	F666B710DA2BED9AC0252C1FA1D00C4A
SHA1:	0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
SHA-256:	F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
SHA-512:	982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
Malicious:	false
Preview:	..........O.........+...........\|.....#.........p?....q?@...r?....s?,...t?....u?....v?\|...w?...x?R...y?...z?'...{?....\|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.\|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..

C:\Users\user\PCAppStore\nwjs\nw_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1134592
Entropy (8bit):	6.555043286804751
Encrypted:	false
SSDEEP:
MD5:	364F839CA8DE4D942270D9097D48EF15
SHA1:	82C8040DC2A733EB3EA3E051513C84F992BB17F1
SHA-256:	A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
SHA-512:	BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B.................@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8..........................@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................

C:\Users\user\PCAppStore\nwjs\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	4656369
Entropy (8bit):	7.995866504972196
Encrypted:	true
SSDEEP:
MD5:	0F1D45867B591D67B0301EE8C4AD5F7B
SHA1:	F5FB6378C13912DF079EFEE44476FC1B4666EF24
SHA-256:	A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
SHA-512:	1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
Malicious:	false
Preview:	............{.,0..\|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?...=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.\|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..\|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0

C:\Users\user\PCAppStore\nwjs\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	686733
Entropy (8bit):	5.111423885670035
Encrypted:	false
SSDEEP:
MD5:	E68978443DDAFD40434C87818C90D338
SHA1:	C38FC19A469E6C9AF4699ABFE00C5FFE39501726
SHA-256:	7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
SHA-512:	D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
Malicious:	false
Preview:	.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B\|....\|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4483072
Entropy (8bit):	6.30617269058202
Encrypted:	false
SSDEEP:
MD5:	DB64B157590C89B63D7E7FCF97FD7A01
SHA1:	64C320EA6A444561E6DEA1E6713DBACDA24B634C
SHA-256:	53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
SHA-512:	5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................

C:\Users\user\PCAppStore\nwjs\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\PCAppStore\nwjs\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	918016
Entropy (8bit):	6.582669085817742
Encrypted:	false
SSDEEP:
MD5:	C59EE747C59CD7B450DB71FD836E7153
SHA1:	8C43131CAF144B0D359662EF0990E992A3EC7C40
SHA-256:	334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
SHA-512:	74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...\|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................

C:\Users\user\PCAppStore\pcappstore.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	1.8361199320851
Encrypted:	false
SSDEEP:
MD5:	815665F58B066A42DE47F55ED686D184
SHA1:	49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
SHA-256:	24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
SHA-512:	62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

C:\Users\user\PCAppStore\ui\asset-manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	4.927996306534048
Encrypted:	false
SSDEEP:
MD5:	4B55D62B16ADCF19F8E466F9988DBEC7
SHA1:	9563339C8D80DAEB5C7B38A21E2EE4A88EEC6760
SHA-256:	19D56A07CD45027047FEDF6E80911711AA85035F3BED3819471709F40CF2A9D4
SHA-512:	BC3D3250EF596664675CA264E85B88B2D8F89355A272DD539B485D01260C7BF038C16D92AF99EA8CA7B352A82C18D9CB749E8394F2272637999E2494AF76F457
Malicious:	false
Preview:	{. "files": {. "main.css": "/static/css/main.c1bf4e0a.chunk.css",. "main.js": "/static/js/main.717b6389.chunk.js",. "main.js.map": "/static/js/main.717b6389.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.801b9d83.chunk.js": "/static/js/2.801b9d83.chunk.js",. "static/js/2.801b9d83.chunk.js.map": "/static/js/2.801b9d83.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.c1bf4e0a.chunk.css.map": "/static/css/main.c1bf4e0a.chunk.css.map",. "static/js/2.801b9d83.chunk.js.LICENSE.txt": "/static/js/2.801b9d83.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta

C:\Users\user\PCAppStore\ui\favicon-16x16.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	278
Entropy (8bit):	6.614793808897997
Encrypted:	false
SSDEEP:
MD5:	8F48B667D8E9CDDFB5054AC4EAC29240
SHA1:	4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
SHA-256:	FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
SHA-512:	27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.

C:\Users\user\PCAppStore\ui\favicon-32x32.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	506
Entropy (8bit):	7.41701077919571
Encrypted:	false
SSDEEP:
MD5:	6B5236D9B2E90E8DE0698738970AD3BC
SHA1:	630268F0F33505B8234B4FAC45D71BE6D9249BB3
SHA-256:	A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
SHA-512:	ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..\|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.

C:\Users\user\PCAppStore\ui\favicon.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	1.9733781811385676
Encrypted:	false
SSDEEP:
MD5:	B71C63AF25F44A21143174E24791FBFB
SHA1:	EA7F0627F790FF60A65EA35B59F2641BB8CE8476
SHA-256:	7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
SHA-512:	B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
Malicious:	false
Preview:	...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

C:\Users\user\PCAppStore\ui\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	HTML document, ASCII text, with very long lines (3269), with no line terminators
Category:	dropped
Size (bytes):	3269
Entropy (8bit):	5.267907599850738
Encrypted:	false
SSDEEP:
MD5:	B7C9F30D797A5B794AA4EDA8CAE5F69A
SHA1:	42F270CF26D97C2DBC2E0A7979CF57FEF333B1A4
SHA-256:	B8B97D7D84A7ED35B5FD7411C572D4B38FF40969E94676010BBB456E76518F60
SHA-512:	D02AE1312B21BAAFD715E8E33FEB3336250F81E27636A914C14FB03F9249317444D53509A5FB26B814F23DC2D684CD27CA490CE06FCDF58322E23FB34854C01C
Malicious:	false
Preview:	<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.c1bf4e0a.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje

C:\Users\user\PCAppStore\ui\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	499
Entropy (8bit):	4.571997514321595
Encrypted:	false
SSDEEP:
MD5:	B6D88DB0D0FF77D182C5BFA47A6649D4
SHA1:	4502E844EE48233B345B3AD057FCD1101EC8F3F4
SHA-256:	8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
SHA-512:	75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
Malicious:	false
Preview:	{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}

C:\Users\user\PCAppStore\ui\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	2511
Entropy (8bit):	4.786444073109678
Encrypted:	false
SSDEEP:
MD5:	BA0268049BD46633F0423F58B70A6766
SHA1:	B5ACE19636832D4C9F4234A041A2399D10B1688C
SHA-256:	DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
SHA-512:	E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
Malicious:	false
Preview:	{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react

C:\Users\user\PCAppStore\ui\robots.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	4.431168424936135
Encrypted:	false
SSDEEP:
MD5:	61C27D2CD39A713F7829422C3D9EDCC7
SHA1:	6AF64D9AC347B7B0B3CFE234A79073CF05A38982
SHA-256:	E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
SHA-512:	29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
Malicious:	false
Preview:	# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..

C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with very long lines (40486)
Category:	dropped
Size (bytes):	40538
Entropy (8bit):	5.038776756689567
Encrypted:	false
SSDEEP:
MD5:	BA8B67B72756499BC9D31F02415F8F95
SHA1:	5DB9B0B789AFC7B9E2DDDE7BBF25A598D2651690
SHA-256:	EE09B0CBE65537C047DEB471B09245846CA63E3B2E8E5D28D08193D59AE7D622
SHA-512:	BF1A868656927498DF639FF0E3CF4F319C4E943B15F0A5206F22B14C33DA6C54078DFB586081F4B39FB29FA65E5C30C0AB1048F7E74964931D893117AEDD1AB7
Malicious:	false
Preview:	.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani

C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css.map

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	75429
Entropy (8bit):	5.131553566266101
Encrypted:	false
SSDEEP:
MD5:	DF0CB96BE26094690EC20638CFD19744
SHA1:	730926C0825BE3FDE3157F5858E7BD2F0C3FB289
SHA-256:	875CB85F5AD444F42D28B88AE54718F386ED5409B6C90F42CDF35615C2770415
SHA-512:	58BA6FDBA602CD1F47AAFE23C65DBE9CA152677C357A5AB4143826DD0004AEAB9798EAE2DFA8315A9346832622E1C5DB7B52D74F9DC0B5F2276CDBFF08576A62
Malicious:	false
Preview:	{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio

C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	673416
Entropy (8bit):	6.007704985977014
Encrypted:	false
SSDEEP:
MD5:	D9722A6FFF2490ED995531238B6E80B6
SHA1:	B5E2FA6E6EA8EAB7181E5A859E977171F138761E
SHA-256:	276590217876291AAD39E9692AF95BC472B34D93A6140AB69F00BCAF4083B80C
SHA-512:	AE7DE7899663F419EC0C8A56F5862AEE738B010735F28FA2681EBBCE99ADD636DC58A36DC74B311615FED6298D14F514C33AE373E04FE8166AA9CF0CACCA0FD6
Malicious:	false
Preview:	.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................

C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.884858891889049
Encrypted:	false
SSDEEP:
MD5:	ACAF465D1FBC096D21C487E89AD7C49F
SHA1:	482DBE33E2BF02052800045CC293B0990742C234
SHA-256:	FCD759D2C151212B5C1B806A584C3CAB0264BF3A27A84FA6D41A3D67EFC4AC5B
SHA-512:	9BD7CD4109222774B02327FFED06E9F045587A0DF4070F013C4EE64647E829BC54329552DABF2C4000AB480BE5A27D0A2EE2F2522C8194239295F0E7641563AF
Malicious:	false
Preview:	nw.Window.get().evalNWBin(null, "static/js/2.801b9d83.chunk.bin");

C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	4.736390551286131
Encrypted:	false
SSDEEP:
MD5:	10A587045DF3F39CD774951756F33E54
SHA1:	2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
SHA-256:	761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
SHA-512:	903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
Malicious:	false
Preview:	/.object-assign.(c) Sindre Sorhus.@license MIT./../! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE /../** @license React v0.20.2. * scheduler.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /../* @license React v16.13.1. * react-is.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /../* @license React v17.0.2. * react-dom.production.min.js. . Copyright (c) Facebook, Inc. and its affiliates.. . This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. /../* @license React v17.0.2. * react-is.production.min.js.

C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.map

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	1024473
Entropy (8bit):	5.423552162642971
Encrypted:	false
SSDEEP:
MD5:	2A4361CFC7094304666213A0F712D10C
SHA1:	E0335FB64225CAD4F915E8D62483734276154AB6
SHA-256:	96949B7DDA0EF31225EB6232B5EDBE97F9A1EF554006EC389A030D81B2FF8BD2
SHA-512:	8A1097C2B7B82689E46015CFD84429745F494F96BF724DF5349D649C34973E13F9F848B8289365EA874879044385A1D5E5AD6A489591C2DC97B8109E9D093599
Malicious:	false
Preview:	{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec

C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	16240
Entropy (8bit):	5.4978991340628935
Encrypted:	false
SSDEEP:
MD5:	1B83BDE47892A049925572BD77B5E3B3
SHA1:	998F7A3CED8FC72502A7108A5A64FC8D2505768F
SHA-256:	5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
SHA-512:	39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
Malicious:	false
Preview:	........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da

C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.8128151418562695
Encrypted:	false
SSDEEP:
MD5:	B3E7D84CF0B8A2298C89F91F084C0809
SHA1:	CE8389EE3CDEBD3DEA5628A441971C723D835D8C
SHA-256:	E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
SHA-512:	69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
Malicious:	false
Preview:	nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");

C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js.map

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	9898
Entropy (8bit):	5.1083863257804785
Encrypted:	false
SSDEEP:
MD5:	B079CA1E88F9F0249B645CF6809C0059
SHA1:	4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
SHA-256:	C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
SHA-512:	4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
Malicious:	false
Preview:	{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc

C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	465368
Entropy (8bit):	6.14942830048273
Encrypted:	false
SSDEEP:
MD5:	5D4D79F5E8C4C5BE596D0D29FE390DB8
SHA1:	BE21E4FB8E1068A14754A02BD6189A38240B0047
SHA-256:	6F0FE0DF3138C4D6793991EA974B6F63F982F86652E8DDFC4E33EE70A5EFB88C
SHA-512:	20CC4165405DC4E0EDEC3AC1713973EB94DAAAAF26EA6CB5FC9EB59321DC85583182916E125744D4C85FAD26F89C1CF08EA8A7F67C036F3BED5571157EBF3035
Malicious:	false
Preview:	.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`........Q.`l........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..

C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.8761250011309585
Encrypted:	false
SSDEEP:
MD5:	99282C810B1320DD7DDF3F1E3C49BCB3
SHA1:	412001989210C2675F1F0F6867E7B76243D37B31
SHA-256:	77E053252D75F968C929769601E19EA05BBBB628307B99B23DBFE6DA511F9936
SHA-512:	953288399F2B8E45D37A8BBEF6D48725F303143E144077C265346A0D900AB1AE8FE8A22B543BC32E8E37C80C840ED1AEBA6C0CC603B0DE126EFFE92B194166AA
Malicious:	false
Preview:	nw.Window.get().evalNWBin(null, "static/js/main.717b6389.chunk.bin");

C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js.map

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	703789
Entropy (8bit):	5.361726899305513
Encrypted:	false
SSDEEP:
MD5:	2A430BD7263C0FF637BCE16595B14F25
SHA1:	1DDA5EB0085930E7F36C947799D7806F08C73D4B
SHA-256:	1095AB40B990F5B4BB57121D8A0DFA575D727B2BA227576260496C1F1E39CFA3
SHA-512:	340521BC1857EF3A8CF9EF2A247AD89C52BB481DAEA26200C23614D42D0BDC09EAD66356E7FA0D46C7EE1687125C5CAC4B2EC40E43DD863256A3894224317CA1
Malicious:	false
Preview:	{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC

C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	data
Category:	dropped
Size (bytes):	6880
Entropy (8bit):	5.780693101615468
Encrypted:	false
SSDEEP:
MD5:	4FA32B7B0E24BED1A9E2E639180C6DAC
SHA1:	929ECB83121E556DED3E3757CDF15F77CB215A66
SHA-256:	088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
SHA-512:	784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
Malicious:	false
Preview:	........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK\|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......

C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	71
Entropy (8bit):	4.7442478245494595
Encrypted:	false
SSDEEP:
MD5:	07D51995B0C40EB6A7D648682400933E
SHA1:	673509F2150E63B0B1C2DA099AAB362214571CBD
SHA-256:	F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
SHA-512:	79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
Malicious:	false
Preview:	nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");

C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js.map

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	12604
Entropy (8bit):	5.32907166018772
Encrypted:	false
SSDEEP:
MD5:	C7F90D5C550BFEECD43C415429428E79
SHA1:	0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
SHA-256:	94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
SHA-512:	092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
Malicious:	false
Preview:	{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",

C:\Users\user\PCAppStore\ui\static\media\copy_icon.570b8027.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.283353360674453
Encrypted:	false
SSDEEP:
MD5:	C28FE12628EAF4B73719080A13F8E1A5
SHA1:	4900054A3A0BA37B054F7E99826AF0008928AAB5
SHA-256:	EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
SHA-512:	6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74

C:\Users\user\PCAppStore\ui\static\media\icon_calculator_gray.f29de877.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	5175
Entropy (8bit):	3.933853115875902
Encrypted:	false
SSDEEP:
MD5:	CF8666E7736704C07412232858C9CBA3
SHA1:	EE8666C41448498D22620353C27EB8489D763249
SHA-256:	E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
SHA-512:	332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
Malicious:	false
Preview:	<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1

C:\Users\user\PCAppStore\ui\static\media\icon_calculator_white.cdac319f.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2823
Entropy (8bit):	4.491649868709728
Encrypted:	false
SSDEEP:
MD5:	0F2E1681746D0E29CF14FE6D88B557D7
SHA1:	BB983801F298AF8693088BC47C6B62C5640D0BDF
SHA-256:	E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
SHA-512:	C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,

C:\Users\user\PCAppStore\ui\static\media\icon_check_gray.fc098a35.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.266600052838456
Encrypted:	false
SSDEEP:
MD5:	6D54B2DFCD9A05985B1D2BDDFD513F60
SHA1:	DE6A21F663DB8895ADC4DB91BBD08A279301322F
SHA-256:	5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
SHA-512:	E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
Malicious:	false
Preview:	<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..

C:\Users\user\PCAppStore\ui\static\media\icon_check_white.f080410d.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	852
Entropy (8bit):	4.275850671375772
Encrypted:	false
SSDEEP:
MD5:	2CCC89303FC39BE9450730A8B415E094
SHA1:	F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
SHA-256:	E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
SHA-512:	D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
Malicious:	false
Preview:	<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..

C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_gray.c8a9351b.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4743
Entropy (8bit):	3.9546492458044593
Encrypted:	false
SSDEEP:
MD5:	386F6BF2308D42F9D6E2B56C6BFB0C51
SHA1:	F59465E5D827949B20728DE697019C28F3E58C78
SHA-256:	4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
SHA-512:	FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
Malicious:	false
Preview:	<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_white.2afacb39.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4729
Entropy (8bit):	3.9826071199242548
Encrypted:	false
SSDEEP:
MD5:	7B3329DB8105F1C10A0432343AA96772
SHA1:	4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
SHA-256:	50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
SHA-512:	6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
Malicious:	false
Preview:	<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

C:\Users\user\PCAppStore\ui\static\media\icon_cross_gray_2.01bfd543.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.004290849514056
Encrypted:	false
SSDEEP:
MD5:	D9F81AE3849F84F6F219B2831F088247
SHA1:	A0F7835AA9CD1261E3E2839B41055A3DD24A8637
SHA-256:	DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
SHA-512:	21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
Malicious:	false
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

C:\Users\user\PCAppStore\ui\static\media\icon_cross_white_2.05921d5e.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.012220474436418
Encrypted:	false
SSDEEP:
MD5:	4DB5D94C4F838E720E17332EDF740EBC
SHA1:	D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
SHA-256:	52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
SHA-512:	8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
Malicious:	false
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_gray.3a181243.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4264
Entropy (8bit):	3.894045254391696
Encrypted:	false
SSDEEP:
MD5:	E25CBB3FF275E58AF7891E0B857550A1
SHA1:	5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
SHA-256:	25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
SHA-512:	BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
Malicious:	false
Preview:	<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985

C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_white.a91ae220.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4238
Entropy (8bit):	3.914834455290012
Encrypted:	false
SSDEEP:
MD5:	2A64F22D46EF697D361BC13F4E5EC382
SHA1:	8F4277EA88024B458509538814E3A50BD20F0F04
SHA-256:	33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
SHA-512:	6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
Malicious:	false
Preview:	<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167

C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_gray.d7229273.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6098
Entropy (8bit):	3.8868971852897896
Encrypted:	false
SSDEEP:
MD5:	8EBCB6408685047BE3BD1996D4000EE4
SHA1:	F16881FF86F16B8C4D725E17584ECE870CD6727F
SHA-256:	BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
SHA-512:	276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
Malicious:	false
Preview:	<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_white.25a7995d.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6086
Entropy (8bit):	3.9063223215918432
Encrypted:	false
SSDEEP:
MD5:	048482A7B181541A174551C016205A44
SHA1:	5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
SHA-256:	968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
SHA-512:	873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
Malicious:	false
Preview:	<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

C:\Users\user\PCAppStore\ui\static\media\icon_gear_gray.545673b6.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6801
Entropy (8bit):	3.7386877939405805
Encrypted:	false
SSDEEP:
MD5:	6DD649E7B024D0758023476637791EFF
SHA1:	47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
SHA-256:	663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
SHA-512:	3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
Malicious:	false
Preview:	<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

C:\Users\user\PCAppStore\ui\static\media\icon_gear_white.2bba31c1.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6797
Entropy (8bit):	3.744755737482207
Encrypted:	false
SSDEEP:
MD5:	C29E6ED919C2A6DE97D06B2AE745DE71
SHA1:	D5FBD0DBFBD471CE494FD822C8846D4460BD1545
SHA-256:	2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
SHA-512:	07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
Malicious:	false
Preview:	<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

C:\Users\user\PCAppStore\ui\static\media\icon_notification_gray.e0145c50.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3605
Entropy (8bit):	3.914389459303166
Encrypted:	false
SSDEEP:
MD5:	477A237F6AE8615FA3C957919C161FFC
SHA1:	735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
SHA-256:	A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
SHA-512:	5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
Malicious:	false
Preview:	<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305

C:\Users\user\PCAppStore\ui\static\media\icon_notification_white.addda272.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3599
Entropy (8bit):	3.928807214825618
Encrypted:	false
SSDEEP:
MD5:	89DD3B8D872E8E8E8D51B3CD29C77023
SHA1:	E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
SHA-256:	A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
SHA-512:	4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
Malicious:	false
Preview:	<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13

C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_gray.01873dbe.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	3.9969278840420657
Encrypted:	false
SSDEEP:
MD5:	73CD1627E147A8EAD813AD7201D75876
SHA1:	9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
SHA-256:	27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
SHA-512:	5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
Malicious:	false
Preview:	<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_white.0e82acc2.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	4.011244246624798
Encrypted:	false
SSDEEP:
MD5:	D4950E85D1EDD93F20A610F0B9575A1B
SHA1:	6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
SHA-256:	4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
SHA-512:	15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
Malicious:	false
Preview:	<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

C:\Users\user\PCAppStore\ui\static\media\icon_search_gray.ebbaf632.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	702
Entropy (8bit):	4.39074490019929
Encrypted:	false
SSDEEP:
MD5:	86893B121171A45F3494D301D57E80F1
SHA1:	739B6A99982CE3F6BF792876E72A8413D1583072
SHA-256:	4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
SHA-512:	CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
Malicious:	false
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..

C:\Users\user\PCAppStore\ui\static\media\icon_search_white.0c376446.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	700
Entropy (8bit):	4.387297248681374
Encrypted:	false
SSDEEP:
MD5:	C6D2A075413FDBCB286B77A97F9B6F13
SHA1:	2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
SHA-256:	A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
SHA-512:	387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
Malicious:	false
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..

C:\Users\user\PCAppStore\ui\static\media\icon_support_gray.a272cc7a.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	3.9394896115708424
Encrypted:	false
SSDEEP:
MD5:	97A4CAA52C453393A3ACEDB7EB240010
SHA1:	26353A64DD09BA4D0055D2F259266DABE7C1CC88
SHA-256:	0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
SHA-512:	F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
Malicious:	false
Preview:	<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

C:\Users\user\PCAppStore\ui\static\media\icon_support_white.66ecfc42.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3460
Entropy (8bit):	3.951932320279216
Encrypted:	false
SSDEEP:
MD5:	7BBD80A02464154C092ACBE7DD328730
SHA1:	C5E8862B03D566CCE19001910B1254D0293C1D9F
SHA-256:	F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
SHA-512:	53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
Malicious:	false
Preview:	<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

C:\Users\user\PCAppStore\ui\static\media\icon_trash_gray.4f9b6bc3.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4403
Entropy (8bit):	3.8960426134967934
Encrypted:	false
SSDEEP:
MD5:	360145CB691391CCC038500BAD652269
SHA1:	4F2D87620766892151D6087962DCB08628FC1220
SHA-256:	4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
SHA-512:	D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
Malicious:	false
Preview:	<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

C:\Users\user\PCAppStore\ui\static\media\icon_trash_white.1601c18d.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4395
Entropy (8bit):	3.9130769273478307
Encrypted:	false
SSDEEP:
MD5:	B0F49189BE082A137803BEA947266CC9
SHA1:	8733164F238BB6BC95614B91715408EA54C54E57
SHA-256:	042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
SHA-512:	B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
Malicious:	false
Preview:	<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_gray.a7446394.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1858
Entropy (8bit):	4.054255384536267
Encrypted:	false
SSDEEP:
MD5:	04FDC7FEDBD2538F8B4A24EC6A737DDB
SHA1:	30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
SHA-256:	E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
SHA-512:	18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
Malicious:	false
Preview:	<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_white.333d83c8.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1854
Entropy (8bit):	4.069519451091226
Encrypted:	false
SSDEEP:
MD5:	FCA164880EE2E1D12B798C98241DCB76
SHA1:	A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
SHA-256:	5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
SHA-512:	90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
Malicious:	false
Preview:	<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

C:\Users\user\PCAppStore\ui\static\media\icon_unpin_gray.712c1820.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2922
Entropy (8bit):	3.8955256034331684
Encrypted:	false
SSDEEP:
MD5:	60F659C2639149E5FE452A99BA232B94
SHA1:	70AB8FCF7714F5C83F9C7C749E95702273CEAF11
SHA-256:	FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
SHA-512:	25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
Malicious:	false
Preview:	<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

C:\Users\user\PCAppStore\ui\static\media\icon_unpin_white.6b8ad10f.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2920
Entropy (8bit):	3.895777405127468
Encrypted:	false
SSDEEP:
MD5:	610CC1A8CF2F609FCD872D217E3D4333
SHA1:	91F5EBF7DFAA1F39123342EFF19176D4432C0388
SHA-256:	AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
SHA-512:	E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
Malicious:	false
Preview:	<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

C:\Users\user\PCAppStore\ui\static\media\icon_weather_gray.6eb05cae.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3445
Entropy (8bit):	3.979453075901205
Encrypted:	false
SSDEEP:
MD5:	8517A7C9AC10921DEBA471DD89A13601
SHA1:	55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
SHA-256:	4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
SHA-512:	6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
Malicious:	false
Preview:	<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2

C:\Users\user\PCAppStore\ui\static\media\icon_weather_white.c0043930.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3425
Entropy (8bit):	4.01234712901125
Encrypted:	false
SSDEEP:
MD5:	0C92AF8318B8C3247643257AF05FD42E
SHA1:	2DD447FF88BC4B9BC48324FEF75D9395867D7462
SHA-256:	0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
SHA-512:	C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
Malicious:	false
Preview:	<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.

C:\Users\user\PCAppStore\ui\static\media\in_background_auto_update_img.dd2961b8.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
File Type:	PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11957
Entropy (8bit):	7.943985153985361
Encrypted:	false
SSDEEP:
MD5:	5D3291D90D252B1C09C262466D67D04A
SHA1:	0AFB93843C13CC71B458D92E5400FC756FEC5691
SHA-256:	4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
SHA-512:	B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z\|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....\|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4855), with no line terminators
Category:	downloaded
Size (bytes):	4855
Entropy (8bit):	5.8206860415984005
Encrypted:	false
SSDEEP:
MD5:	0E2712F1EE1D255EA6F941BA78A1C27F
SHA1:	F239B5AB65A75E95B1F60144C07823F257113C10
SHA-256:	BB6713763731456B1063BE3D4B92A647CC065C9788C2E2DE5240BD7C7C2C0BB6
SHA-512:	9A4DBABC74F98053201114939AF52D723D29502616BD642EC6970A857EA9909F64A8FE96C2C54755963A75D9B2E03567C34BE640E997AF5243219AAE63EC2E65
Malicious:	false
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730848410182&cv=11&fst=1730848410182&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1920&u_h=1080&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D00000000-0000-0000-0000-D05099DB2397%26_fcid%3D1730846226315208%26_winver%3D19042%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=726160546.1730848410&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4951), with no line terminators
Category:	downloaded
Size (bytes):	4951
Entropy (8bit):	5.841101966348778
Encrypted:	false
SSDEEP:
MD5:	29F2629DD81699143DC941C68F0D7584
SHA1:	A1EE61A6580061F7CB824FCA61EC22B048A24F9A
SHA-256:	B0C730D55C79B5B4C87F7D5A62B7C4A8E050BDA21EB5D3C87B185D1D6D8F08BC
SHA-512:	2B31F748AF0391F85ACC38ECBED1A3A10E05D1E819D77D38AC00DF7314237521983F5B866F1C623ACE220AC73C9A9BC6EF04D49556FD0A26918A4F11E2DBF101
Malicious:	false
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730848410701&cv=11&fst=1730848410701&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1920&u_h=1080&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D00000000-0000-0000-0000-D05099DB2397%26_fcid%3D1730846226315208%26_winver%3D19042%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=726160546.1730848410&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14408)
Category:	downloaded
Size (bytes):	438956
Entropy (8bit):	5.62633765120606
Encrypted:	false
SSDEEP:
MD5:	F617303B3C37D09F24F98F0CAF56AEF1
SHA1:	7E95A08DA323DF18BA34E2419A00A8D25CCEBDD7
SHA-256:	1EF00A075F7C7F0139353DA35B6545269BE3E77D604B39D67234656D1D969119
SHA-512:	5E35020F380AE8C9EACFE583BF61F462FF34A7C8BDB7AC17C1DA3E7E51C7C8BF96ED8BF440EB81141D1D554EC60E1596A145953C088D1992D6C127916D6E91D0
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (22117), with no line terminators
Category:	downloaded
Size (bytes):	22117
Entropy (8bit):	5.547023583219424
Encrypted:	false
SSDEEP:
MD5:	565EA4CBEB5BCF3ACA830B0996A3240F
SHA1:	8681B9AEA6298F07DCC0F545FEE2418B40265211
SHA-256:	CDF5949574DC8FA1D80C31DA1441EB03FBA59412F947A3EE6D8F2A94EC357373
SHA-512:	864DF20437E64ED4B2FD7557BF52B6AE53EE3D9A6CCC8349A9C00C11D355A92B2D515C90C057B4434CED5207C65DDE88EBB1AF03DDB6EA5CC8D4521537FE6EF8
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/858128210?random=1730848410197&cv=11&fst=1730848410197&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1920&u_h=1080&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D00000000-0000-0000-0000-D05099DB2397%26_fcid%3D1730846226315208%26_winver%3D19042%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=726160546.1730848410&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s726160546.1730848410","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s726160546.1730848410\u0026ig_key=1sNHM3MjYxNjA1NDYuMTczMDg0ODQxMA!2sZ3nAmw!3sAAptDV6QhexN","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sLxPI_g!2sZ3nAmw!3sAAptDV6QhexN"],"userBiddingSignals":[["7904705661","7900466892","7896384790","475816165","596093288","7904283812"],null,1730848411602188],"ads":[{"renderUrl":"https://tdsf.doubleclick.

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	downloaded
Size (bytes):	80097
Entropy (8bit):	5.340756849336266
Encrypted:	false
SSDEEP:
MD5:	18B2A701734EE01149C8C6721BE2EEEB
SHA1:	149DFCA2FDF66D1EE9CA29BDCBA984719FC4FAFF
SHA-256:	A4B1DB472A3CF2E3EAB7AFA9AD6DA36115BA144166668AF8E097C65E50BD2D06
SHA-512:	048CA68548BA7DF2DD26D18A75008977F63F2CB42428B47BB09BEF69A76673B4087B5B1F5289A3946C988103D4E3A1326BE8253443BB75BB8F62372160F60518
Malicious:	false
URL:	https://connect.facebook.net/signals/config/2010038472609365?v=2.9.176&r=stable&domain=veryfast.io&hme=872f04a0547459b3285cb03b0d7a47bfde40628f4b386809918a621e2688602f&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14408)
Category:	dropped
Size (bytes):	438982
Entropy (8bit):	5.6263766297212605
Encrypted:	false
SSDEEP:
MD5:	EAA18EBC51E0A8C5915AB4952EC5EB36
SHA1:	673C1EBD709A9E2178D97DE5EE320DDFF6F3BA1D
SHA-256:	A1D0ED25EA5BFE2745F44E7E3E2DBD6621072B402631F1EBABF446217DBC722E
SHA-512:	A6AADD865BBA169FCCF170B79C0728542CABAA763A820A33EB99DADF73990E5837BEF34375B14E1D2A65770493CAE5201CE11504252C24EF32553ED3B4112C99
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3592
Entropy (8bit):	4.71780114350715
Encrypted:	false
SSDEEP:
MD5:	0FFC071BC5AF33D2BE224CF147670471
SHA1:	5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
SHA-256:	1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
SHA-512:	205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
Malicious:	false
URL:	https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
Preview:	<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3969)
Category:	dropped
Size (bytes):	290586
Entropy (8bit):	5.559350913994766
Encrypted:	false
SSDEEP:
MD5:	A58BCC8FEA3E3EBEBADF2AD3623D722E
SHA1:	A9F6F8F7FE43D78E43DB5321969CB313EEE06840
SHA-256:	79CE98097D5987992F6A040AA2411E87E12BF1BC68C4632D0688E79804F868F3
SHA-512:	A02018FDC2AF5CA65EBAF2552AC714B424051971D05C02CAC5579C347644C02995B2CD97CE620AA4861875B36B8AE73AF368FEA51B23067728B22CEEEBC00823
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3969)
Category:	downloaded
Size (bytes):	290586
Entropy (8bit):	5.559350913994766
Encrypted:	false
SSDEEP:
MD5:	A58BCC8FEA3E3EBEBADF2AD3623D722E
SHA1:	A9F6F8F7FE43D78E43DB5321969CB313EEE06840
SHA-256:	79CE98097D5987992F6A040AA2411E87E12BF1BC68C4632D0688E79804F868F3
SHA-512:	A02018FDC2AF5CA65EBAF2552AC714B424051971D05C02CAC5579C347644C02995B2CD97CE620AA4861875B36B8AE73AF368FEA51B23067728B22CEEEBC00823
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=AW-858128210
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3592
Entropy (8bit):	4.71780114350715
Encrypted:	false
SSDEEP:
MD5:	0FFC071BC5AF33D2BE224CF147670471
SHA1:	5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
SHA-256:	1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
SHA-512:	205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
Malicious:	false
Preview:	<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14408)
Category:	downloaded
Size (bytes):	438982
Entropy (8bit):	5.626460645536282
Encrypted:	false
SSDEEP:
MD5:	D1F24548996A1FE866F751DB40E560B4
SHA1:	49E335BB785A0DE019C0538C6B5B2674BF4E6994
SHA-256:	85CC07D8CF97A66466B656F4048543F7244B6C61899932CE12A872E1450536F7
SHA-512:	D67051962BE92AE108E1BF2553063E6841F5E10B9A31430B66173831041666F5E1E427565A78CF96D4F8C2364AA49552F5EE3F47BA506232C2A81F4A4596C71A
Malicious:	false
URL:	https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	5973
Entropy (8bit):	5.385847419693263
Encrypted:	false
SSDEEP:
MD5:	207F621B4209616283D091A5A0F8CD49
SHA1:	D34E96207B74C7446771ED458DDB74AE78121E93
SHA-256:	5780DCB011235F74EBD060A2E1D7E214E3BD12E13982BF4BD7FBE052D3D55F63
SHA-512:	91EA88B5F95863ABBB93E69AF3D7F68BD0D5C3716C5294869A64D5C08C573DA8FE1695279B397D7E7765431863013AC7AFB6DA00559C49AA49E6D4E87580C306
Malicious:	false
URL:	https://fonts.googleapis.com/css?family=Open%20Sans
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-fa

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9217)
Category:	downloaded
Size (bytes):	244295
Entropy (8bit):	5.454185343611895
Encrypted:	false
SSDEEP:
MD5:	B5322CFCA51C69074051C6B148CE5A6C
SHA1:	A995F0F78FE3147A4BF3D0503F9A123FDDAD0CD0
SHA-256:	55270971FDC4172D5CBBA95DADD779074EADB9C50BF16C2B3253CCC6BC8FC363
SHA-512:	9D1824E860609AF7AB2775ACE28D22DED11D4678B89351B34BC03A54527D7C3029238DE45C126E52150B9A87F9242039679F3A646A2F5C7E46D66EE19BB051BE
Malicious:	false
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.606800268124855
Encrypted:	false
SSDEEP:
MD5:	8D1ED092B3BE364DC47574F1310D2C87
SHA1:	D5BBA623B5AFB4C5B6C0AD5ED04A10F1881DA595
SHA-256:	07B61E98466A1F851D5DCF555AD9B901684EE622275129B98C38DA3785506FF2
SHA-512:	70134A9B5B786473A56F11BA7098CA6AF568EEF97AA8704A9748A5EFDFC4F16CEE1F9C22CEA9F55660BE4FEB14D6C1B5B09A7C76076D4F813A58FECF27BB8828
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....jIDATx..VKK.Q....R."..q.....Z.\|.P....."b..'.......XiE..B6.6Z.c4.8....nf.$Nf&^. d1.w..9'...$.(.2N.V.\|.&....g...8.E.%].y.G_$8...O.H..4....%..>.N...P.....K..V9Z..4f..Y.,..T.pGi.%.?8.,@..W.'q...g...}p8....y.5r.......)......&....(.WrD_V.er.).h.....t....c~sN..u&S....Z.m\|.n..c.-_.A....(...._....X....,.hBD..<Z..Yk.V..._7V...U.........;....'....F..>;B..8.^.f../.:.. a?]..\.l......&@dD.g..y.r.p.g....fG<......M...r.....c..,...FJ,W...2G...d.9Q.4..5{4D...,._Oe.......Csbw.M~......dU.........j.0W.....r...'.s6..S......n...E...V@..e.$V....rfeN7.I...z+..`..R.,.N.]...>z..i#..~b.....N'..~0go.].*....I.e.x........[.S......IEND.B`.

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4871), with no line terminators
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	5.827549163562027
Encrypted:	false
SSDEEP:
MD5:	9A229150E80FF370917C744A7948CB54
SHA1:	9D18370A0CCA3E561039FDA7AB969E7CB5D5310B
SHA-256:	73C36ECBA88849062A2D6871602D21C397197B679CADEEA33547053A7C54A69A
SHA-512:	F51B4829C5911B20FE6CFB9C7B55EEF8E57237C5DC9AC9F1606D12197B643BE261658CF9AE1AB978203EF7606C6BAF256A53B26F0660AB3FE08DB2CCC6D7FBAF
Malicious:	false
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
Category:	downloaded
Size (bytes):	48444
Entropy (8bit):	7.995593685409469
Encrypted:	true
SSDEEP:
MD5:	8E433C0592F77BEB6DC527D7B90BE120
SHA1:	D7402416753AE1BB4CBD4B10D33A0C10517838BD
SHA-256:	F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
SHA-512:	5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
Malicious:	false
URL:	https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
Preview:	wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,..6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl\|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K.............$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2118
Entropy (8bit):	4.907323279161229
Encrypted:	false
SSDEEP:
MD5:	1039640CF0666A1621D55C9E9FA81439
SHA1:	A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
SHA-256:	4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
SHA-512:	F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
Malicious:	false
Preview:	<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (22117), with no line terminators
Category:	downloaded
Size (bytes):	22117
Entropy (8bit):	5.5471072251715325
Encrypted:	false
SSDEEP:
MD5:	3C6828288C7C775D8411899E6249317F
SHA1:	84986D9A17D44D81772AE63CBA2EA4D97AE42B89
SHA-256:	0BADF48EE0B79DBB87F7B90466958DA131C349CFBF03869D55278C1093F88C8F
SHA-512:	A503FE6E54B61DDB735FD676EC1E1A6226F89FAEAC64988C3533F1F86E2C26B10599AAE26D5D563A05F1533E68E09731B1469E10D4447640929F478D653C9C13
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/858128210?random=1730848410182&cv=11&fst=1730848410182&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1920&u_h=1080&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D00000000-0000-0000-0000-D05099DB2397%26_fcid%3D1730846226315208%26_winver%3D19042%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=726160546.1730848410&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s726160546.1730848410","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s726160546.1730848410\u0026ig_key=1sNHM3MjYxNjA1NDYuMTczMDg0ODQxMA!2sZ3nAmw!3sAAptDV6QhexN","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sLxPI_g!2sZ3nAmw!3sAAptDV6QhexN"],"userBiddingSignals":[["596093288","7904283812","7900466892","7896384790","7904705661","475816165"],null,1730848411603089],"ads":[{"renderUrl":"https://tdsf.doubleclick.

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2499
Entropy (8bit):	5.4636477793325495
Encrypted:	false
SSDEEP:
MD5:	382991778933FB8F5697DEB2EE26A0ED
SHA1:	6CDED0C76F01EA3C3C6DB8128B5CF59063A92C78
SHA-256:	0919FF36779EEF85FA50AF4B94FB2D496A765612B7C5EDD31BA69EA1F4136736
SHA-512:	FC05BAFD9EB747B7060B8C730E8A467CFD0A0311622B325E5EB74A1083D3A7B8897396CF4FE310E7567EAA1B5A951AB3906F57E57671F2852A18ED1AD0E7E2C9
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4970), with no line terminators
Category:	dropped
Size (bytes):	4970
Entropy (8bit):	5.849631651028046
Encrypted:	false
SSDEEP:
MD5:	765105D2FCF806105364C3E0A9C4F3B5
SHA1:	48E02F548545B32BC0484F27D5C9F00B7FCB7966
SHA-256:	E7DB2F58BD703CCC2062F47567A68A3884EB278E1ED4B1B5C70F60168AC234AE
SHA-512:	58B5DD511EDFF878DC5A9C1EA7AE3B72582602D4FFABD0EDE2F5AF3017B909407C42BCF4892FE18D44054BC73CB7521BA3E80805C4E159EE3040A205A77FE162
Malicious:	false
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	675
Entropy (8bit):	7.606800268124855
Encrypted:	false
SSDEEP:
MD5:	8D1ED092B3BE364DC47574F1310D2C87
SHA1:	D5BBA623B5AFB4C5B6C0AD5ED04A10F1881DA595
SHA-256:	07B61E98466A1F851D5DCF555AD9B901684EE622275129B98C38DA3785506FF2
SHA-512:	70134A9B5B786473A56F11BA7098CA6AF568EEF97AA8704A9748A5EFDFC4F16CEE1F9C22CEA9F55660BE4FEB14D6C1B5B09A7C76076D4F813A58FECF27BB8828
Malicious:	false
URL:	https://repository.pcapp.store/pcapp/images/fast.png
Preview:	.PNG........IHDR... ... .....szz....jIDATx..VKK.Q....R."..q.....Z.\|.P....."b..'.......XiE..B6.6Z.c4.8....nf.$Nf&^. d1.w..9'...$.(.2N.V.\|.&....g...8.E.%].y.G_$8...O.H..4....%..>.N...P.....K..V9Z..4f..Y.,..T.pGi.%.?8.,@..W.'q...g...}p8....y.5r.......)......&....(.WrD_V.er.).h.....t....c~sN..u&S....Z.m\|.n..c.-_.A....(...._....X....,.hBD..<Z..Yk.V..._7V...U.........;....'....F..>;B..8.^.f../.:.. a?]..\.l......&@dD.g..y.r.p.g....fG<......M...r.....c..,...FJ,W...2G...d.9Q.4..5{4D...,._Oe.......Csbw.M~......dU.........j.0W.....r...'.s6..S......n...E...V@..e.$V....rfeN7.I...z+..`..R.,.N.]...>z..i#..~b.....N'..~0go.].*....I.e.x........[.S......IEND.B`.

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	3501
Entropy (8bit):	5.383873370647921
Encrypted:	false
SSDEEP:
MD5:	147FD3B00C22BA9C939712E9213C24CA
SHA1:	3B48369B86FA0574F35379AACD1F42CC9C98A52B
SHA-256:	70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
SHA-512:	E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
Malicious:	false
URL:	https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcapp.store
Preview:	<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGERMath.random()))}}function n(a){return a.performance&&a.performance.now()\|\|Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (22131), with no line terminators
Category:	downloaded
Size (bytes):	22131
Entropy (8bit):	5.547962187148845
Encrypted:	false
SSDEEP:
MD5:	144954F45EC4237BF601A5D84FA768D7
SHA1:	44E794BC2477F8A1C1DDE3F370031040119CE96E
SHA-256:	08EEAFEE3F9614874A8E861BFE6AD7E486D4CA4ABB181F2FC34E11CC2D5192B8
SHA-512:	1082B88B75AFF9CD014D906A52BCF70D3B7BBEC7D65AB7BBDDC65C34F703B12C97A7D88201107D63A5505AB0849ABC224C88180489DC503DA8EC172CFF53D719
Malicious:	false
URL:	https://td.doubleclick.net/td/rul/858128210?random=1730848410701&cv=11&fst=1730848410701&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1920&u_h=1080&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D00000000-0000-0000-0000-D05099DB2397%26_fcid%3D1730846226315208%26_winver%3D19042%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=726160546.1730848410&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s726160546.1730848410","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s726160546.1730848410\u0026ig_key=1sNHM3MjYxNjA1NDYuMTczMDg0ODQxMA!2saQVCnA!3sAAptDV4QjZhC","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sLxPI_g!2saQVCnA!3sAAptDV4QjZhC"],"userBiddingSignals":[["7900466892","7896384790","475816165","7904283812","7904705661","596093288","8552333481"],null,1730848412013120],"ads":[{"renderUrl":"https://tds

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1978406245.1730848410&gtm=45je4au0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&z=859615603
Preview:	<html></html>

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4871), with no line terminators
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	5.836609773272614
Encrypted:	false
SSDEEP:
MD5:	9C935622B7E45363850BA8F5C4B66922
SHA1:	5E2F485B94A26816E92E605B1CF27C6951BE3F37
SHA-256:	96F5B8775C0C27A6162981186B8344B1F03B954043727928BF71869074141256
SHA-512:	424665E31F62851AD95361430D1715267EFE8EA2A2FC81D43EB56E04F60D1561BA425E8EE7ED38F23CA1196CE9B0CDB82E25CA87C72F3E1F1F6DA27D271B9557
Malicious:	false
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Category:	downloaded
Size (bytes):	18668
Entropy (8bit):	7.988119248989337
Encrypted:	false
SSDEEP:
MD5:	8655D20BBCC8CDBFAB17B6BE6CF55DF3
SHA1:	90EDBFA9A7DABB185487B4774076F82EB6412270
SHA-256:	E7AF9D60D875EB1C1B1037BBBFDEC41FCB096D0EBCF98A48717AD8B07906CED6
SHA-512:	47308DE25BD7E4CA27F59A2AE681BA64393FE4070E730C1F00C4053BAC956A9B4F7C0763C04145BC50A5F91C12A0BF80BDD4B03EECC2036CD56B2DB31494CBAF
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Preview:	wOF2......H...........H..........................\|.....h.`?STAT^..0..\|...........+..2..6.$..`. ..x........z'o..w;....6.E....6....E...'$H.#.....n1X..JU/.d.O..JC.'J".v.v.l.h.....u.S...SY.....B.hz.o.}......W......%m6...A..=....\..m. .]..~.[..........]...I..h.=.....6.xt..F....Lt...Qs-.7..{...~BI.".F.Q......F...P..dMw..#I2........Rq.Q&.0@.;..;...3VG..:c.nki..-Q..2##e.u...8n....\?....T..b....^..#...../.J\|OM..St....e.S.}!.....>..i.T/a.ES%.W.P3..`..a.R.A.....!~g..74.np8o.....d[6?.P.4)P.....AG.3.......;#0.y....M..O/2.@.4..N.vA$.:M&H,.AT".........@..a.~..L->...0@h...~.._..N"......t......C./g7..............2E.N.J...TW.F..."A.B...n.......i.?.{\.L.!.B..x...S..!........?.\,... .@.....y"xw.A8.w..!E..-^P O..+.T.r.R.zz..K..].E.....Ri.)g.P...j..w..c.M.F.v../........Q....'...(....X..;.K.!BZ3.........f.....N.A(....cA`.b'...`.~sa^.....?..../.L.S......t..`@h..C.....>N.W...;>..._h.+~=\|......uOGA{.7.....h....q.d.4$.x<.....^0\|...@....@Q[RC.0....b....'...RID

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14408)
Category:	dropped
Size (bytes):	438956
Entropy (8bit):	5.626370108019169
Encrypted:	false
SSDEEP:
MD5:	30BA51F93EBCF57380432A9DCBD53681
SHA1:	E843D574E0DA09EA93CCFDA3C165E8A066C6DC02
SHA-256:	2147173E63A377A5F56FFAF795F4AC44A2BBC67A33D09071B471A9ACCB26365C
SHA-512:	AB625BD7B1E83155D52885F73DE431FD0329584D50647C689CA0192AC086AC6BA52675817AB07CE6182C4E32E9EA9617BB122C3996DCAAEC1D56B1698F431A3E
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9217)
Category:	dropped
Size (bytes):	244295
Entropy (8bit):	5.454185343611895
Encrypted:	false
SSDEEP:
MD5:	B5322CFCA51C69074051C6B148CE5A6C
SHA1:	A995F0F78FE3147A4BF3D0503F9A123FDDAD0CD0
SHA-256:	55270971FDC4172D5CBBA95DADD779074EADB9C50BF16C2B3253CCC6BC8FC363
SHA-512:	9D1824E860609AF7AB2775ACE28D22DED11D4678B89351B34BC03A54527D7C3029238DE45C126E52150B9A87F9242039679F3A646A2F5C7E46D66EE19BB051BE
Malicious:	false
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	dropped
Size (bytes):	80097
Entropy (8bit):	5.340756849336266
Encrypted:	false
SSDEEP:
MD5:	18B2A701734EE01149C8C6721BE2EEEB
SHA1:	149DFCA2FDF66D1EE9CA29BDCBA984719FC4FAFF
SHA-256:	A4B1DB472A3CF2E3EAB7AFA9AD6DA36115BA144166668AF8E097C65E50BD2D06
SHA-512:	048CA68548BA7DF2DD26D18A75008977F63F2CB42428B47BB09BEF69A76673B4087B5B1F5289A3946C988103D4E3A1326BE8253443BB75BB8F62372160F60518
Malicious:	false
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (723)
Category:	downloaded
Size (bytes):	7076
Entropy (8bit):	5.52488676121649
Encrypted:	false
SSDEEP:
MD5:	88A2E0A522036C0B87E03552E56629AA
SHA1:	EC9D1157518E753A84DBDE1333A29B34CF776D63
SHA-256:	788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
SHA-512:	44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
Malicious:	false
URL:	https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
Preview:	'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var m=this\|\|self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData\|\|null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")\|\|K("CriOS"))&&!(L()?0:K("Edge"))\|\|K("Silk")};!K("Android")\|\|O();O();!K("Safari")\|\|O()\|\|(L()?0:K("Coast"))\|\|(L()?0:K("Opera"))\|\|(L()?0:K("Edge"))\|\|(L()?J("Microsoft Edge"):K("Edg/"))\|\|L()&

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4853), with no line terminators
Category:	downloaded
Size (bytes):	4853
Entropy (8bit):	5.825534904673833
Encrypted:	false
SSDEEP:
MD5:	8808849E1563F6A9D0807BB8CB38CB3B
SHA1:	5F58EE2FEF9DACFAD3E9B38FDB6E8465DDCDB9C5
SHA-256:	9C40BE614C00836D31B4CB8E82C8FB6DA82A80A421C91B955A60F878D7CB7B5C
SHA-512:	4E8215FFF33016E6E62752AD6F99D3AE34FF44203EAC3215492C5993CEBA192AFC0D845F756FF51F08752610C02A61B8D931154F60501F19CA6D24E5A354A8BC
Malicious:	false
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730848410197&cv=11&fst=1730848410197&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1920&u_h=1080&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D00000000-0000-0000-0000-D05099DB2397%26_fcid%3D1730846226315208%26_winver%3D19042%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=726160546.1730848410&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d\|\|a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2118
Entropy (8bit):	4.907323279161229
Encrypted:	false
SSDEEP:
MD5:	1039640CF0666A1621D55C9E9FA81439
SHA1:	A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
SHA-256:	4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
SHA-512:	F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
Malicious:	false
URL:	https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
Preview:	<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.61274971005279
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	190'056 bytes
MD5:	6309770ca668239c93a093e885a362e2
SHA1:	e6b1bafe8723468b1c191f46d2c0a21d61e896e6
SHA256:	27c5187ed2c3272fadb508d182ca580e77161ed2699e53e39f151dc22cb89aef
SHA512:	88ebe5f4a7bfd0962bbecdc5a88de32041acb8edbda6c61b1c7ed9ee4119a4f52ab607987d7547e3733660cced643b566511da82dacb727a942ed99f73ce93d5
SSDEEP:	3072:UbG7N2kDTHUpouL4Ynd86Pzy5n+/mGCK8izuG2okB2h4l591BBgkXmUa:UbE/HUzRe6ry5nmQiiGz4z9TJXra
TLSH:	1904F15056E0C862D8A28B71B5797F7B8AB5DC2192B45F8313107B187E7DE819F0E3A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

File Icon


Icon Hash:	45d44c7192498005

Static PE Info

General

Entrypoint:	0x40352d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/05/2024 02:00:00 14/02/2025 00:59:59
Subject Chain	CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
Version:	3
Thumbprint MD5:	04786BD703B906E22AECB2AD38CE4D94
Thumbprint SHA-1:	07BE42727905BE32C822A638502C1B8FAAE6540A
Thumbprint SHA-256:	FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
Serial:	0E5C655E1CBE9A8879372F58A5BC0302

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007FE1CCDB28EAh
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007FE1CCDB28BAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [00434FB8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c000	0x4f40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2bd00	0x2968	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6897	0x6a00	ce9df19df15aa7bfbc0a8d0af0b841d0	False	0.6661261792452831	data	6.458398214928006	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a6	0x1600	a118375c929d970903c1204233b7583d	False	0.4392755681818182	data	5.024109281264143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2b018	0x600	82a10c59a8679bb952fc8316070b8a6c	False	0.521484375	data	4.15458210408643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x36000	0x36000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6c000	0x4f40	0x5000	6147c56de0951034d77b52b0075b790f	False	0.1015625	data	2.760740823683962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6c208	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/m	English	United States	0.036372224846480866
RT_DIALOG	0x70430	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x70638	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x70730	0xa0	data	English	United States	0.60625
RT_DIALOG	0x707d0	0xee	data	English	United States	0.6302521008403361
RT_GROUP_ICON	0x708c0	0x14	data	English	United States	1.1
RT_VERSION	0x708d8	0x240	data	English	United States	0.4895833333333333
RT_MANIFEST	0x70b18	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	18:13:19
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	190'056 bytes
MD5 hash:	6309770CA668239C93A093E885A362E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:13:25
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=00000000-0000-0000-0000-D05099DB2397&winver=19042&version=fa.1092c&nocache=20241105181325.34&_fcid=1730846226315208
Imagebase:	0x7ff636550000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:13:26
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2176,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2212 /prefetch:3
Imagebase:	0x7ff636550000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:13:29
Start date:	05/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Imagebase:	0x7ff773220000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	18:13:29
Start date:	05/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Imagebase:	0x7ff773220000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:13:30
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=4844,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5408 /prefetch:8
Imagebase:	0x7ff636550000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:13:30
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-subproc-heap-profiling --field-trial-handle=5204,i,11907367456306388257,12963148072136716127,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=5196 /prefetch:8
Imagebase:	0x7ff636550000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:13:36
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\nsy2C04.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force
Imagebase:	0x400000
File size:	93'386'616 bytes
MD5 hash:	84EE733F8014D22DAD2DFEF725489980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:14:07
Start date:	05/11/2024
Path:	C:\Users\user\PCAppStore\PcAppStore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Imagebase:	0x7ff64b8a0000
File size:	3'116'888 bytes
MD5 hash:	4B88D8ADA8D22622C30D581FC38EAA52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:14:07
Start date:	05/11/2024
Path:	C:\Users\user\PCAppStore\Watchdog.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\PCAppStore\Watchdog.exe" /guid=00000000-0000-0000-0000-D05099DB2397 /rid=20241105181407.1816081953 /ver=fa.1092c
Imagebase:	0x7ff733c50000
File size:	276'312 bytes
MD5 hash:	11F3801CB9FF046D6075F681971C4EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:14:07
Start date:	05/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff7187c0000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	18:14:12
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:14:13
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	18:14:13
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	18:14:13
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	18:14:14
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	18:14:14
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	18:14:14
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	18:14:15
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	18:14:15
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	18:14:15
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	18:14:15
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	18:14:16
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	18:14:16
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	18:14:16
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	18:14:17
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	18:14:17
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	18:14:17
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	18:14:17
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	18:14:18
Start date:	05/11/2024
Path:	C:\Users\user\PCAppStore\PcAppStore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Imagebase:	0x7ff64b8a0000
File size:	3'116'888 bytes
MD5 hash:	4B88D8ADA8D22622C30D581FC38EAA52
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:14:18
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	18:14:18
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	18:14:19
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	18:14:19
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	18:14:20
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	18:14:20
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	18:14:20
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	18:14:20
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	18:14:20
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	18:14:21
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	18:14:21
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	18:14:21
Start date:	05/11/2024
Path:	C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\bXseErgRACaHGFcFYIDMCELjOMSOHhEoXkoqJAUxIIBZImRURAEAGqCWcQqhvVYUWGZsWSwwH\tddPFIUbTNWNQ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	28.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.6%
Total number of Nodes:	1349
Total number of Limit Nodes:	40

Executed Functions

Function 0040352D Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 00403550
GetVersionExW.KERNEL32(?), ref: 00403579
GetVersionExW.KERNEL32(0000011C), ref: 00403590
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
OleInitialize.OLE32(00000000), ref: 0040366A
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
DeleteFileW.KERNEL32(1033), ref: 0040386F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403956
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403965

Part of subcall function 00405AEB: CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403970
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,?), ref: 004039FB
CopyFileW.KERNEL32(C:\Users\user\Desktop\Setup.exe,0042AA28,00000001), ref: 00403A0E
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
ExitProcess.KERNEL32(?), ref: 00403A59
CoUninitialize.COMBASE(?), ref: 00403A5E
ExitProcess.KERNEL32 ref: 00403A78
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
ExitProcess.KERNEL32 ref: 00403B0C

Strings

C:\Users\user\AppData\Local\Temp\nsy2C04.tmp, xrefs: 004039BB
UXTHEME, xrefs: 0040361B, 00403620, 00403626
1033, xrefs: 0040386A
NSIS Error, xrefs: 0040368E
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FE, 00403803, 00403819, 00403825, 00403834, 00403841, 0040384D, 00403855, 00403953, 00403964, 0040396F, 0040397B, 0040398C, 0040399B, 00403A51
Low, xrefs: 0040383C
C:\Users\user\Desktop\Setup.exe, xrefs: 00403A09
.tmp, xrefs: 0040396A
\Temp, xrefs: 00403820
SeShutdownPrivilege, xrefs: 00403AA1
TMP, xrefs: 00403856
Error launching installer, xrefs: 004038FF
~nsu, xrefs: 0040394E
TEMP, xrefs: 0040384E

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsy2C04.tmp$C:\Users\user\Desktop\Setup.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-1935044647
Opcode ID: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
Opcode Fuzzy Hash: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D

Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040573C
GetDlgItem.USER32(?,000003EE), ref: 0040574B
GetClientRect.USER32(?,?), ref: 00405788
GetSystemMetrics.USER32(00000002), ref: 0040578F
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
ShowWindow.USER32(?,00000008), ref: 0040582B
GetDlgItem.USER32(?,000003EC), ref: 0040584C
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
GetDlgItem.USER32(?,000003F8), ref: 0040575A

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

GetDlgItem.USER32(?,000003EC), ref: 0040589E
CreateThread.KERNEL32(00000000,00000000,Function_00005672,00000000), ref: 004058AC
CloseHandle.KERNEL32(00000000), ref: 004058B3
ShowWindow.USER32(00000000), ref: 004058D7
ShowWindow.USER32(00030432,00000008), ref: 004058DC
ShowWindow.USER32(00000008), ref: 00405926
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
CreatePopupMenu.USER32 ref: 0040596B
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
GetWindowRect.USER32(?,?), ref: 0040599F
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
OpenClipboard.USER32(00000000), ref: 00405A00
EmptyClipboard.USER32 ref: 00405A06
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
GlobalLock.KERNEL32(00000000), ref: 00405A1C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
GlobalUnlock.KERNEL32(00000000), ref: 00405A50
SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
CloseClipboard.USER32 ref: 00405A61

Strings

{, xrefs: 00405944

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
Opcode Fuzzy Hash: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58

Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*,?,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBA
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*,?,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CDD
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*,?,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*,?,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
FindClose.KERNEL32(00000000), ref: 00405DA2

Strings

., xrefs: 00405D18
C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*, xrefs: 00405CA2, 00405CA8, 00405CB9, 00405CF2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C56
., xrefs: 00405D04
\*.*, xrefs: 00405CB4

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsz155E.tmp\*.*$\*.*
API String ID: 2035342205-318818092
Opcode ID: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
Opcode Fuzzy Hash: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE

Function 00406873 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(76113420,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\,76113420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76113420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
FindClose.KERNEL32(00000000), ref: 0040688A

Strings

C:\, xrefs: 00406873

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD

Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
ShowWindow.USER32(?), ref: 00403FF6
GetWindowLongW.USER32(?,000000F0), ref: 00404008
ShowWindow.USER32(?,00000004), ref: 00404021
DestroyWindow.USER32 ref: 00404035
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
GetDlgItem.USER32(?,?), ref: 0040406D
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
IsWindowEnabled.USER32(00000000), ref: 00404088
GetDlgItem.USER32(?,00000001), ref: 00404133
GetDlgItem.USER32(?,00000002), ref: 0040413D
SetClassLongW.USER32(?,000000F2,?), ref: 00404157
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
GetDlgItem.USER32(?,00000003), ref: 0040424E
ShowWindow.USER32(00000000,?), ref: 0040426F
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040429C
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
EnableMenuItem.USER32(00000000), ref: 004042B9
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
SetWindowTextW.USER32(?,0042D268), ref: 00404322
ShowWindow.USER32(?,0000000A), ref: 00404456

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID:
API String ID: 3964124867-0
Opcode ID: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
Opcode Fuzzy Hash: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D

Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76113420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C6D
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76113420), ref: 00403CED
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
GetFileAttributesW.KERNEL32(Remove folder: ,?,00000000,?), ref: 00403D0B
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00440800), ref: 00403D54

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

RegisterClassW.USER32(00433EA0), ref: 00403D91
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
RegisterClassW.USER32(00433EA0), ref: 00403E56
DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75

Strings

RichEdit, xrefs: 00403E47
RichEd20, xrefs: 00403E1A
.exe, xrefs: 00403CFA
1033, xrefs: 00403C0C, 00403C68
_Nb, xrefs: 00403D70, 00403DD8
.DEFAULT\Control Panel\International, xrefs: 00403C58
C:\Users\user\AppData\Local\Temp\, xrefs: 00403BF1
Control Panel\Desktop\ResourceLocale, xrefs: 00403C20
Remove folder: , xrefs: 00403CB4, 00403CBD, 00403CCB, 00403D1A, 00403D20
RichEdit20W, xrefs: 00403E38, 00403E3E
RichEd32, xrefs: 00403E28

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-586292101
Opcode ID: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
Opcode Fuzzy Hash: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D

Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040308E
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA

Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,C:\Users\user\Desktop\Setup.exe,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
GlobalAlloc.KERNEL32(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403084
Error launching installer, xrefs: 004030CD
C:\Users\user\Desktop\Setup.exe, xrefs: 00403094, 004030A3, 004030B7, 004030D7
}8@, xrefs: 00403227, 00403242
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403253
Null, xrefs: 00403174
Inst, xrefs: 00403162
soft, xrefs: 0040316B

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\Setup.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
API String ID: 2803837635-356152588
Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D

Function 0040657A Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 00406695
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00000000,00424420,761123A0), ref: 004066A8
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000), ref: 00406779

Strings

C:\Users\user\AppData\Local\Temp\nsy2C04.tmp, xrefs: 0040674E
Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\, xrefs: 0040659F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406663
Remove folder: , xrefs: 004065A4, 00406657, 0040665E, 00406662, 0040667F, 00406694, 004066A7, 004066BC, 004066E9, 0040671E, 00406724, 00406741, 00406754, 00406772, 00406778, 00406781, 004067B7
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406719

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsy2C04.tmp$Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-1825706899
Opcode ID: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
Opcode Fuzzy Hash: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D

Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040331E
GetTickCount.KERNEL32 ref: 004033C5
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033EE
wsprintfW.USER32 ref: 00403401

Strings

... %d%%, xrefs: 004033FB
*B, xrefs: 004032DF
A, xrefs: 0040347E
DB, xrefs: 004033A2, 004033BD, 0040343A
tClientRect, xrefs: 00403338
}8@, xrefs: 004032B4
A, xrefs: 00403374

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ DB$ A$ A$... %d%%$tClientRect$}8@
API String ID: 551687249-400812307
Opcode ID: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
Opcode Fuzzy Hash: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,get,00441000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00441000,?,?,00000031), ref: 004017D5

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Strings

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsz155E.tmp, xrefs: 00401821, 0040183F
get, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsz155E.tmp$C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll$get
API String ID: 1941528284-3145632369
Opcode ID: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
Opcode Fuzzy Hash: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D

Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0), ref: 004055FA
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\), ref: 0040560C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000), ref: 00406779

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\, xrefs: 004055C0, 004055D0, 004055D6, 004055F9, 00405605

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\
API String ID: 1495540970-3229371147
Opcode ID: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
Opcode Fuzzy Hash: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
wsprintfW.USER32 ref: 004068EC
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900

Strings

UXTHEME, xrefs: 004068A3
%s%S.dll, xrefs: 004068E6
\, xrefs: 004068C2

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8

Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
GetLastError.KERNEL32 ref: 00405AC5
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
GetLastError.KERNEL32 ref: 00405AE4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3355392842
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz155E.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nsz155E.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsz155E.tmp
API String ID: 2655323295-1758848421
Opcode ID: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
Opcode Fuzzy Hash: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58

Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,76113420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,76113420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,76113420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76113420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F14
C:\, xrefs: 00405F1A, 00405F1F, 00405F25, 00405F66, 00405F6C, 00405F74, 00405F7C

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-2214159804
Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE

Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040607A
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406061
nsa, xrefs: 00406069

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768

Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76113420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
GlobalFree.KERNEL32(?), ref: 00403B78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
Opcode Fuzzy Hash: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(0087C620), ref: 00401C0B
GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D

Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000), ref: 00406779

Strings

get, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFreelstrcatlstrlen
String ID: get
API String ID: 3292104215-4248514160
Opcode ID: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
Instruction ID: 7c0f58a685d1fc6dd3685da305ee1819882fb4420ac17dc2787245939102450a
Opcode Fuzzy Hash: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
Instruction Fuzzy Hash: 1B21D872904210EBDB20AFA8EE84A5E73B4EB04715755063BF552F72D0D7B8AC414B9D

Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
Opcode Fuzzy Hash: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D

Function 00405C01 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406008: GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
Part of subcall function 00406008: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021

RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C1C
DeleteFileW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C24
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C3C

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
Instruction ID: 0274c5225d47ddc366315f3a2fda4b694ad97aa72442a0e2fcdbaf00fd257d87
Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
Instruction Fuzzy Hash: F4E0E53110CF9156E61457309E08F5F2AD8EF86715F05493EF892B10C0CBB848068E6A

Function 00404472 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000408,?,00000000,004040D1), ref: 00404490

Strings

x, xrefs: 00404472

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
Instruction ID: 1b38e0d23eed931a714c5b599c5829f4d2050063c4158495342b67dc2c27a344
Opcode Fuzzy Hash: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
Instruction Fuzzy Hash: 10C01271140200EACB004B00DE01F0A7A20B7A0B02F209039F381210B087B05422DB0C

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,76113420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A6E: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1

SetCurrentDirectoryW.KERNEL32(?,00441000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
Opcode Fuzzy Hash: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsz155E.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
Opcode Fuzzy Hash: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D

Function 00401F12 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405B63: ShellExecuteExW.SHELL32(?), ref: 00405B72

Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Strings

@, xrefs: 00401F8A

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
String ID: @
API String ID: 165873841-2766056989
Opcode ID: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
Instruction ID: 706d8f23dd4fc365793d21c3b3cee38f3579e955c6bce5a1691758ef83551cc9
Opcode Fuzzy Hash: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
Instruction Fuzzy Hash: 20115B71E042189ADB50EFB9CA49B8CB6F4BF04304F24447AE405F72C1EBBC89459B18

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
Opcode Fuzzy Hash: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D

Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
CloseHandle.KERNEL32(?), ref: 00405B56

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78

Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
GetProcAddress.KERNEL32(00000000,?), ref: 00406937

Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
Part of subcall function 0040689A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
Opcode Fuzzy Hash: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E

Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
InvalidateRect.USER32(?), ref: 00402C24

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
Instruction ID: 5efb85e177e5feb05262591b5578bbf68be0fc1facb886aaf0ec985341d6bcc2
Opcode Fuzzy Hash: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
Instruction Fuzzy Hash: CEE08C72700008FFEB01CBA4EE84DAEB779FB40315B00007AF502A00A0D7300D40DA28

Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98

Function 00403B12 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D

Strings

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\, xrefs: 00403B31

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\
API String ID: 2962429428-369848528
Opcode ID: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
Opcode Fuzzy Hash: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D

Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
GetLastError.KERNEL32 ref: 00405AFF

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D

Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028AF

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D

Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675

Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4

Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4

Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00406438,?,00000000,?,?,Remove folder: ,?), ref: 004063CE

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764

Function 00404499 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000), ref: 00406779

SetDlgItemTextW.USER32(?,?,00000000), ref: 004044B3

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ItemTextlstrcatlstrlen
String ID:
API String ID: 281422827-0
Opcode ID: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
Instruction ID: 6ac98b26730712a62f5b3967fa7f39b4c61dbbfa6ef1674fce18da22a1fc1fc0
Opcode Fuzzy Hash: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
Instruction Fuzzy Hash: D3C08C35008200BFD641A714EC42F0FB7A8FFA031AF00C42EB05CA10D1C63494208A2A

Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(0002042A,00000000,00000000,00000000), ref: 004044F7

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C

Function 00405B63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405B72

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08

Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000,00424420,761123A0), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 00405B20: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
Opcode Fuzzy Hash: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

Non-executed Functions

Function 0040498A Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049D9
SetWindowTextW.USER32(00000000,?), ref: 00404A03
SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
CoTaskMemFree.OLE32(00000000), ref: 00404ABF
lstrcmpiW.KERNEL32(Remove folder: ,0042D268,00000000,?,?), ref: 00404AF1
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404AFD
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B0F

Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94

Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
Part of subcall function 004067C4: CharNextW.USER32(?,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
Part of subcall function 004067C4: CharPrevW.USER32(?,?,76113420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED

Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03

Strings

C:\Users\user\AppData\Local\Temp\nsy2C04.tmp, xrefs: 004049A3
A, xrefs: 00404AAD
Remove folder: , xrefs: 00404AEB, 00404AF0, 00404AFB

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\nsy2C04.tmp$Remove folder:
API String ID: 2624150263-4029320013
Opcode ID: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
Opcode Fuzzy Hash: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D

Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
Opcode Fuzzy Hash: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
Opcode Fuzzy Hash: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29

Function 00406D85 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45

Function 0040755C Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95

Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F1E
GetDlgItem.USER32(?,00000408), ref: 00404F29
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
DeleteObject.GDI32(00000000), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
ImageList_Destroy.COMCTL32(?), ref: 00405330
GlobalFree.KERNEL32(?), ref: 00405340
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
SendMessageW.USER32(?,00001102,?,?), ref: 00405462
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
ShowWindow.USER32(?,00000000), ref: 004054EA
GetDlgItem.USER32(?,000003FE), ref: 004054F5
ShowWindow.USER32(00000000), ref: 004054FC

Strings

N, xrefs: 0040519B
M, xrefs: 004050BA
, xrefs: 004054D4

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
Opcode Fuzzy Hash: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58

Function 00404658 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
GetDlgItem.USER32(?,000003E8), ref: 0040470A
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
GetSysColor.USER32(?), ref: 00404738
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
lstrlenW.KERNEL32(?), ref: 00404759
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
GetDlgItem.USER32(?,0000040A), ref: 004047D4
SendMessageW.USER32(00000000), ref: 004047DB
GetDlgItem.USER32(?,000003E8), ref: 00404806
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
LoadCursorW.USER32(00000000,00007F02), ref: 00404857
SetCursor.USER32(00000000), ref: 0040485A
LoadCursorW.USER32(00000000,00007F00), ref: 00404873
SetCursor.USER32(00000000), ref: 00404876
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7

Strings

N, xrefs: 004047F4
Remove folder: , xrefs: 00404835

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Remove folder:
API String ID: 3103080414-3051863454
Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7

Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
wsprintfA.USER32 ref: 00406202
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
GlobalFree.KERNEL32(00000000), ref: 004062EB
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2

Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Strings

%ls=%ls, xrefs: 004061F8
[Rename], xrefs: 0040626C, 0040627E

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
Opcode Fuzzy Hash: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D

Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040451D
GetSysColor.USER32(00000000), ref: 0040455B
SetTextColor.GDI32(?,00000000), ref: 00404567
SetBkMode.GDI32(?,?), ref: 00404573
GetSysColor.USER32(?), ref: 00404586
SetBkColor.GDI32(?,?), ref: 00404596
DeleteObject.GDI32(?), ref: 004045B0
CreateBrushIndirect.GDI32(?), ref: 004045BA

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54

Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
CharNextW.USER32(?,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
CharPrevW.USER32(?,?,76113420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

Strings

*?|<>/":, xrefs: 00406816
C:\Users\user\AppData\Local\Temp\, xrefs: 004067C5

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2977677972
Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD

Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
GetMessagePos.USER32 ref: 00404E77
ScreenToClient.USER32(?,?), ref: 00404E91
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9

Strings

f, xrefs: 00404EA5

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\,00000000), ref: 00406779

CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Strings

MS Shell Dlg, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID: MS Shell Dlg
API String ID: 2584051700-76309092
Opcode ID: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
Opcode Fuzzy Hash: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED

Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
MulDiv.KERNEL32(0002BCFB,00000064,0002E668), ref: 00402FDC
wsprintfW.USER32 ref: 00402FEC
SetWindowTextW.USER32(?,?), ref: 00402FFC
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E

Strings

verifying installer: %d%%, xrefs: 00402FE6

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
Opcode Fuzzy Hash: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
Opcode Fuzzy Hash: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68

Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
wsprintfW.USER32 ref: 00404DF0
SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03

Strings

%u.%u%s%s, xrefs: 00404DD1

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
Opcode Fuzzy Hash: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8

Function 00405EB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,76113420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,76113420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
CharNextW.USER32(00000000), ref: 00405ECA
CharNextW.USER32(00000000), ref: 00405EE2

Strings

C:\, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
Instruction ID: b7f7aa27055ddc775a1b47344aef2f77b81fec2ea34db2f3ccdabfa21b6bce3d
Opcode Fuzzy Hash: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
Instruction Fuzzy Hash: 7BF0F631810E1296DB317B548C44E7B97BCEB64354B04843BD741B71C0D3BC8D808BDA

Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC
C:\Users\user\AppData\Local\Temp\nsz155E.tmp, xrefs: 00402683

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsz155E.tmp$C:\Users\user\AppData\Local\Temp\nsz155E.tmp\inetc.dll
API String ID: 1659193697-1882371206
Opcode ID: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
Instruction ID: edf8e5a6553ae7ef136857fb61bcac29e22bbc78049b19fa22ca3c34260198f3
Opcode Fuzzy Hash: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
Instruction Fuzzy Hash: 2611EB71A00215BBCB10BFB18E4AAAE7665AF40744F25443FE002B71C2EAFC8891565E

Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
GetTickCount.KERNEL32 ref: 0040304A
CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D

Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405542
CallWindowProcW.USER32(?,?,?,?), ref: 00405593

Part of subcall function 004044E5: SendMessageW.USER32(0002042A,00000000,00000000,00000000), ref: 004044F7

Strings

, xrefs: 00405523

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69

Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Remove folder: ,?,?,00406672,80000002), ref: 00406451
RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsz155E.tmp\), ref: 0040645C

Strings

Remove folder: , xrefs: 00406412

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
Opcode Fuzzy Hash: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8

Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

Memory Dump Source

Source File: 00000000.00000002.4780653540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4780622555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780680294.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4780705307.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4781301993.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

Analysis Process: nsy2C04.tmpPID: 8364, Parent PID: 1940COMMON

Execution Graph

Execution Coverage:	20%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1386
Total number of Limit Nodes:	31

Executed Functions

Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force,00000020,"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force,00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNEL32(1033), ref: 00403982
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force,00000000,?), ref: 00403A69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force,00000000,?), ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force,00000000,?), ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force,00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,6081953,?), ref: 00403B0E
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,00420F08,00000001), ref: 00403B21
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
ExitProcess.KERNEL32(?), ref: 00403B6C
CoUninitialize.COMBASE(?), ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00403A88, 00403A8D, 00403AC0
6081953, xrefs: 00403ACE
UXTHEME, xrefs: 0040372E, 00403733, 00403739
TEMP, xrefs: 00403961
C:\Users\user\PCAppStore, xrefs: 00403901, 00403A30, 00403AB7, 00403AC1
C:\Users\user\PCAppStore, xrefs: 00403A3B
Error launching installer, xrefs: 00403A12
C:\Users\user\AppData\Local\Temp\nsy2C04.tmp, xrefs: 00403B1C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64
"C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force, xrefs: 004037B6, 004037BC, 004037D1, 004039A8, 004039B4, 00403A02, 00403A0C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
\Temp, xrefs: 00403933
SeShutdownPrivilege, xrefs: 00403BB4
TMP, xrefs: 00403969
.tmp, xrefs: 00403A7D
1033, xrefs: 0040397D
~nsu, xrefs: 00403A61
Low, xrefs: 0040394F
NSIS Error, xrefs: 004037A1

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nsy2C04.tmp" /internal 1730846226315208 /force$.tmp$1033$6081953$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsy2C04.tmp$C:\Users\user\PCAppStore$C:\Users\user\PCAppStore$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-2515804137
Opcode ID: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,76113420,76112EE0,00000000), ref: 00405D9D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*,?,?,76113420,76112EE0,00000000), ref: 00405DE5
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*,?,?,76113420,76112EE0,00000000), ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*,?,?,76113420,76112EE0,00000000), ref: 00405E0E
FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*,?,?,76113420,76112EE0,00000000), ref: 00405E1E
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNEL32(00000000), ref: 00405ECD

Strings

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*, xrefs: 00405DCD, 00405DD3, 00405DE4, 00405E1D
., xrefs: 00405E43
\*.*, xrefs: 00405DDF
., xrefs: 00405E2F

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\nsa5834.tmp\*.*$\*.*
API String ID: 2035342205-1843984256
Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(76113420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,76113420,?,76112EE0,00405D94,?,76113420,76112EE0), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,76113420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
lstrlenW.KERNEL32(get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,76113420), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32(get,?,00000000,?), ref: 00403E36
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\PCAppStore), ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32(00429200), ref: 00403EBC
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
RegisterClassW.USER32(00429200), ref: 00403F81
DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0

Strings

get, xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E17, 00403E35, 00403E45, 00403E4B
RichEd20, xrefs: 00403F45
C:\Users\user\PCAppStore, xrefs: 00403DA7, 00403DAF, 00403E52, 00403E58, 00403E68
H7B, xrefs: 00403D43
RichEdit20W, xrefs: 00403F63, 00403F69
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C
RichEd32, xrefs: 00403F53
Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B
.DEFAULT\Control Panel\International, xrefs: 00403D83
1033, xrefs: 00403D37, 00403D93
RichEdit, xrefs: 00403F72
.exe, xrefs: 00403E25
_Nb, xrefs: 00403E9B, 00403F03

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\PCAppStore$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$get
API String ID: 1975747703-689544761
Opcode ID: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,80000000,00000003), ref: 00403149
GlobalAlloc.KERNEL32(00000040,?), ref: 0040328B

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040312B, 00403130, 00403136
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
Error launching installer, xrefs: 00403120
soft, xrefs: 004031BE
C:\Users\user\AppData\Local\Temp\nsy2C04.tmp, xrefs: 004030EA, 004030F9, 0040310D, 0040312A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
Null, xrefs: 004031C7
Inst, xrefs: 004031B5
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsy2C04.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1621536749
Opcode ID: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Function 004066A5 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(get,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32(get,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

get, xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2
6081953, xrefs: 00406879
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: 6081953$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$get
API String ID: 4260037668-232701268
Opcode ID: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll, xrefs: 00401835, 00401851
C:\Users\user\PCAppStore, xrefs: 0040179E
get, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsa5834.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsa5834.tmp$C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll$C:\Users\user\PCAppStore$get
API String ID: 1941528284-2187339701
Opcode ID: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B

Strings

UXTHEME, xrefs: 004069CE
%s%S.dll, xrefs: 00406A11
\, xrefs: 004069ED

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3355392842
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5834.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nsa5834.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsa5834.tmp
API String ID: 2655323295-2973138001
Opcode ID: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
Opcode Fuzzy Hash: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004061A5
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

nsa, xrefs: 00406194
C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\, xrefs: 00403C5B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsa5834.tmp\
API String ID: 2962429428-1099018199
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,76113420,?,76112EE0,00405D94,?,76113420,76112EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\PCAppStore,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\PCAppStore, xrefs: 00401640

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\PCAppStore
API String ID: 1892508949-3527889612
Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,76113420,?,76112EE0,00405D94,?,76113420,76112EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,76113420,?,76112EE0,00405D94,?,76113420,76112EE0,00000000), ref: 00406098
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,76113420,?,76112EE0,00405D94,?,76113420,76112EE0), ref: 004060A8

Strings

P_B, xrefs: 00406045

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNEL32(12F86091,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
Opcode Fuzzy Hash: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(03A54198), ref: 00401C0B
GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D

Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

get, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Global$AllocFreelstrcatlstrlen
String ID: get
API String ID: 3292104215-4248514160
Opcode ID: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
Opcode Fuzzy Hash: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD

Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
Instruction ID: fdd171a53236be04b49e80cc8c25aaf428e2db1c32e81cf7e645575326a8d696
Opcode Fuzzy Hash: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
Instruction Fuzzy Hash: 35017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61D0EBB85E45966D

Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406133: GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
Part of subcall function 00406133: SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C

RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D47
DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Users\user\PCAppStore, xrefs: 00402269

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\PCAppStore
API String ID: 542301482-3527889612
Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,get,?), ref: 004064F9

Strings

('B, xrefs: 004064D5

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Open
String ID: ('B
API String ID: 71445658-2332581011
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728

Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsa5834.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
Opcode Fuzzy Hash: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
CloseHandle.KERNEL32(?), ref: 00405C81

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76113420,00000000,76112EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
GlobalFree.KERNEL32(?), ref: 00403CA3

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,80000000,00000003), ref: 0040615C
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34

Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000,00412A94,0040CEF0,00403579,0040CEF0,00412A94,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 00405C4B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
Part of subcall function 00406AE0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B13

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
Opcode Fuzzy Hash: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

Non-executed Functions

Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405867
GetDlgItem.USER32(?,000003EE), ref: 00405876
GetClientRect.USER32(?,?), ref: 004058B3
GetSystemMetrics.USER32(00000002), ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32(?,000003EC), ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32(?,000003F8), ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32(?,000003EC), ref: 004059C9
CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
CloseHandle.KERNEL32(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
GetWindowRect.USER32(?,?), ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32(00000000), ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

H7B, xrefs: 00405AF7
{, xrefs: 00405A6F

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00405049
GetDlgItem.USER32(?,00000408), ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32(?), ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32(?,000003FE), ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

, xrefs: 004055FF
M, xrefs: 004051E5
N, xrefs: 004052C6

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
GetDlgItem.USER32(?,?), ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32(?,00000001), ref: 0040425E
GetDlgItem.USER32(?,00000002), ref: 00404268
SetClassLongW.USER32(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32(?,00000003), ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
EnableWindow.USER32(?,?), ref: 004043AC
EnableWindow.USER32(?,?), ref: 004043C7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
EnableMenuItem.USER32(00000000), ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32(?,00423748), ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

H7B, xrefs: 00404429

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: H7B
API String ID: 1860320154-2300413410
Opcode ID: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
GetDlgItem.USER32(?,000003E8), ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32(?), ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32(?,0000040A), ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32(?,000003E8), ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32(00000000,00007F02), ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

get, xrefs: 00404960
N, xrefs: 0040491F

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$get
API String ID: 3103080414-214687294
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Function 00404AB5 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B04
SetWindowTextW.USER32(00000000,?), ref: 00404B2E
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32(get,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32(?,get), ref: 00404C28
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?,76113420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

get, xrefs: 00404C16, 00404C1B, 00404C26
6081953, xrefs: 00404ACE
C:\Users\user\PCAppStore, xrefs: 00404C05
H7B, xrefs: 00404BB2
A, xrefs: 00404BD8

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: 6081953$A$C:\Users\user\PCAppStore$H7B$get
API String ID: 2624150263-272213476
Opcode ID: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32(00000000), ref: 00406416
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

uB, xrefs: 00406304
[Rename], xrefs: 00406397, 004063A9
%ls=%ls, xrefs: 00406323
uB, xrefs: 0040630B
mB, xrefs: 004062D7

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
SetWindowTextW.USER32(00422728,00422728), ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

('B, xrefs: 004056EB

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: ('B
API String ID: 1495540970-2332581011
Opcode ID: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32(00000000), ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32(?), ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
CharNextW.USER32(?,00000000,76113420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
CharPrevW.USER32(?,?,76113420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

Strings

*?|<>/":, xrefs: 00406941
C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2977677972
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403049
GetTickCount.KERNEL32 ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,00015C8B), ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32(?,?), ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32(?,?), ref: 00402FF5
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007

Strings

unpacking data: %d%%, xrefs: 00402FD3, 00402FE3
verifying installer: %d%%, xrefs: 00402FDA

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

H7B, xrefs: 00404F04
%u.%u%s%s, xrefs: 00404EFC

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,get,?,?,0040679D,80000002), ref: 0040657C
RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,get,get,get,00000000,00422728), ref: 00406587

Strings

get, xrefs: 0040653D
('B, xrefs: 0040655B

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CloseQueryValue
String ID: ('B$get
API String ID: 3356406503-1955485993
Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
lstrcatW.KERNEL32(?,0040A014), ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC
C:\Users\user\AppData\Local\Temp\nsa5834.tmp, xrefs: 00402683

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsa5834.tmp$C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll
API String ID: 1659193697-2352780313
Opcode ID: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
Opcode Fuzzy Hash: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,80000000,00000003), ref: 00405F89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,C:\Users\user\AppData\Local\Temp\nsy2C04.tmp,80000000,00000003), ref: 00405F99

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405F83

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-670666241
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000007.00000002.5205279645.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.5205207149.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205347624.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000425000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000427000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.000000000042B000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000430000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000433000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000435000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000454000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5205435016.0000000000457000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.5206051404.000000000045F000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_nsy2C04.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Analysis Process: PcAppStore.exePID: 8752, Parent PID: 8364COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF64B9295B0 Relevance: 72.6, APIs: 30, Strings: 11, Instructions: 865
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpOpen.WINHTTP ref: 00007FF64B929A21
GetLastError.KERNEL32 ref: 00007FF64B929A88
WinHttpSetTimeouts.WINHTTP ref: 00007FF64B929B6B
WinHttpCloseHandle.WINHTTP ref: 00007FF64B929B7E
GetLastError.KERNEL32 ref: 00007FF64B929BC7
WinHttpConnect.WINHTTP ref: 00007FF64B929CA9
WinHttpCloseHandle.WINHTTP ref: 00007FF64B929CC5
GetLastError.KERNEL32 ref: 00007FF64B929D0E
WinHttpOpenRequest.WINHTTP ref: 00007FF64B929EBB
WinHttpCloseHandle.WINHTTP ref: 00007FF64B929EE5
WinHttpCloseHandle.WINHTTP ref: 00007FF64B929EF0
GetLastError.KERNEL32 ref: 00007FF64B929F39

Part of subcall function 00007FF64BAC3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B8C227F), ref: 00007FF64BAC3DF0
Part of subcall function 00007FF64BAC3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B8C227F), ref: 00007FF64BAC3E31

WinHttpSendRequest.WINHTTP ref: 00007FF64B92A030
WinHttpReceiveResponse.WINHTTP ref: 00007FF64B92A045
WinHttpQueryHeaders.WINHTTP ref: 00007FF64B92A08D
GetLastError.KERNEL32 ref: 00007FF64B92A0A2
WinHttpQueryHeaders.WINHTTP ref: 00007FF64B92A127
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A1AD
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A1B8
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A1C3
GetLastError.KERNEL32 ref: 00007FF64B92A20C
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A394
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A39F
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A3AA
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF64B92A51C
GetLastError.KERNEL32 ref: 00007FF64B92A56C
WinHttpReadData.WINHTTP ref: 00007FF64B92A6B8
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A86A
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A875
WinHttpCloseHandle.WINHTTP ref: 00007FF64B92A880

Strings

URL format is not valid : %ws, xrefs: 00007FF64B929850
handle request or response failure, xrefs: 00007FF64B92A1DA
query data not available, xrefs: 00007FF64B92A53A
timeout init failure, xrefs: 00007FF64B929B95
GET, xrefs: 00007FF64B929DE3
handle connection failure, xrefs: 00007FF64B929CDC
WinHTTP 1.0, xrefs: 00007FF64B929985
^(https?://(?:www.)?([^/]+))(/.*)?$, xrefs: 00007FF64B929606
file creation failure, xrefs: 00007FF64B92A3C1
handle request creation failure, xrefs: 00007FF64B929F07
handle initialization failure, xrefs: 00007FF64B929A56

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Http$CloseHandle$ErrorLast$Query$DataHeadersOpenRequest$AvailableConnectExceptionFileHeaderRaiseReadReceiveResponseSendTimeouts
String ID: GET$URL format is not valid : %ws$WinHTTP 1.0$^(https?://(?:www.)?([^/]+))(/.*)?$$file creation failure$handle connection failure$handle initialization failure$handle request creation failure$handle request or response failure$query data not available$timeout init failure
API String ID: 1266729962-202491335
Opcode ID: a1859295019b1885de16e352e21e90b23f21142ad1b1302a3e01634e5ef6bab9
Instruction ID: fd2057f0e086e702c3432984c21b26fe3727a7d07a35adc51cb4d37dac7a83f9
Opcode Fuzzy Hash: a1859295019b1885de16e352e21e90b23f21142ad1b1302a3e01634e5ef6bab9
Instruction Fuzzy Hash: FAA2C53261DAC295EA70BB10E8913EBB365FBC9740F405536D68D83AAAEF3CD545CB40

Function 00007FF64B951860 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNEL32 ref: 00007FF64B95188B
LoadResource.KERNEL32 ref: 00007FF64B95189D
LockResource.KERNEL32 ref: 00007FF64B9518AD
SizeofResource.KERNEL32 ref: 00007FF64B9518BF
GlobalAlloc.KERNEL32 ref: 00007FF64B9518D6
GlobalLock.KERNEL32 ref: 00007FF64B9518E6
GlobalUnlock.KERNEL32 ref: 00007FF64B95190D
CreateStreamOnHGlobal.OLE32 ref: 00007FF64B951922
GetLastError.KERNEL32 ref: 00007FF64B95192C

Strings

&, xrefs: 00007FF64B95194D
PNG, xrefs: 00007FF64B951871

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: GlobalResource$Lock$AllocCreateErrorFindLastLoadSizeofStreamUnlock
String ID: &$PNG
API String ID: 3493741157-3047161795
Opcode ID: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
Instruction ID: 577475bc5a0a14e70f27e06455679d69c1c56920c4c979f2db02ee6d8fc4c14b
Opcode Fuzzy Hash: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
Instruction Fuzzy Hash: D931957661CB8586D760AB15F49436AB7B0FB8E794F104136EA8E83B79DF3CD1548B00

Function 00007FF64B8B8790 Relevance: 18.0, APIs: 2, Strings: 8, Instructions: 500
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

directory_switching_error, xrefs: 00007FF64B8B8BFB
ui_termination_error, xrefs: 00007FF64B8B89D9
.\ui\., xrefs: 00007FF64B8B8E67
product, xrefs: 00007FF64B8B8831
UI StartedMain process ID:%d, xrefs: 00007FF64B8B87AC
ui_creation_failed, xrefs: 00007FF64B8B88B6
creation_error=%ws, xrefs: 00007FF64B8B893B
.\nwjs\NW_store.exe, xrefs: 00007FF64B8B8E28

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID:
String ID: .\nwjs\NW_store.exe$.\ui\.$UI StartedMain process ID:%d$creation_error=%ws$directory_switching_error$product$ui_creation_failed$ui_termination_error
API String ID: 0-2964731665
Opcode ID: ad4cc86c9edad79a3be5b25b10a68e8f980b1a949aa8f3274e09367b564bd655
Instruction ID: 9b83a8b12563cb4034e624aa29624ce7a5d6cc7fe061fc950367096696997c75
Opcode Fuzzy Hash: ad4cc86c9edad79a3be5b25b10a68e8f980b1a949aa8f3274e09367b564bd655
Instruction Fuzzy Hash: 7D42C63264DAC2A5DA71BB24E4912EBB364FBC9740F401536E68C82B7AEF3CD555CB40

Function 00007FF64B90BFE0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 210
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FF64B90C0DE
GetProcAddress.KERNEL32 ref: 00007FF64B90C0ED

Strings

CoIncrementMTAUsage, xrefs: 00007FF64B90C0E3
.dll, xrefs: 00007FF64B90C24A
combase.dll, xrefs: 00007FF64B90C0D7
combase.dll, xrefs: 00007FF64B90C067
DllGetActivationFactory, xrefs: 00007FF64B90C2C4
RoGetActivationFactory, xrefs: 00007FF64B90C060

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$combase.dll
API String ID: 2574300362-4170001172
Opcode ID: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
Instruction ID: 4b17de963a3e4cd62c566bbbb42985773db5a24db36fd598ac2ead72ce7e46b3
Opcode Fuzzy Hash: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
Instruction Fuzzy Hash: DFB10F3260DA8291DA60FB25E4513FAA764FBDA790F404132E68DC3ABADF3CD545DB40

Function 00007FF64BAF1274 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF64BAF137A
CreateFileW.KERNEL32 ref: 00007FF64BAF13CA
GetLastError.KERNEL32 ref: 00007FF64BAF13FA
GetFileType.KERNEL32 ref: 00007FF64BAF140F
GetLastError.KERNEL32 ref: 00007FF64BAF1419
CloseHandle.KERNEL32 ref: 00007FF64BAF144C
CloseHandle.KERNEL32 ref: 00007FF64BAF15AF
CreateFileW.KERNEL32 ref: 00007FF64BAF15E4
GetLastError.KERNEL32 ref: 00007FF64BAF15F3

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: File$CreateErrorLast$CloseHandle$Type
String ID:
API String ID: 352418905-0
Opcode ID: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
Instruction ID: 31caebc1e2d8e522ea82ec75bc319a52e43c018629111c300d13944417a4c5c4
Opcode Fuzzy Hash: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
Instruction Fuzzy Hash: C3C1B136B28A4585EB50EFA9C4946AC3762FB49BA8F010235DE1E977A5DF38D0A1C310

Function 00007FF64BAA75F8 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,?,?,?,?,00007FF64B9443CA), ref: 00007FF64BAA7619
FindFirstFileExW.KERNEL32 ref: 00007FF64BAA763B
GetLastError.KERNEL32 ref: 00007FF64BAA764E
GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B9443CA), ref: 00007FF64BAA7674
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B9443CA), ref: 00007FF64BAA7691

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorFindLast$CloseCurrentDirectoryFileFirst
String ID:
API String ID: 2053822218-0
Opcode ID: 09b9f346d3f10768f2854e58ae502533ef0d6213524300248e0eb877981d225b
Instruction ID: caeecb784c4dc6def83bcae2ae7b8830a5ed84a0633574ab116a4f39873deb54
Opcode Fuzzy Hash: 09b9f346d3f10768f2854e58ae502533ef0d6213524300248e0eb877981d225b
Instruction Fuzzy Hash: 06113D72A0C64282E7207F65E54433AA7A0FB4DBA4F144734DB6D86AE4DF3DD4948B20

Function 00007FF64B935130 Relevance: 3.0, APIs: 2, Instructions: 14keyboardCOMMON

Download Yara Rule

APIs

keybd_event.USER32 ref: 00007FF64B935141
keybd_event.USER32 ref: 00007FF64B935154

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: keybd_event
String ID:
API String ID: 2665452162-0
Opcode ID: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
Instruction ID: 607235a2b5b71b37da6ab625f8dc778132f958a0e676e6a5e3ce36f5f3233620
Opcode Fuzzy Hash: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
Instruction Fuzzy Hash: 8FD0C970B1916342E7B03B61BD6AFA50FA07B5FBC9FA2B820C9040BF70CD1A12890750

Function 00007FF64B8F3D10 Relevance: 52.1, APIs: 7, Strings: 22, Instructions: 1375
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32 ref: 00007FF64B8F3D9F
ShellExecuteExW.SHELL32 ref: 00007FF64B8F4ACA
WaitForSingleObject.KERNEL32 ref: 00007FF64B8F5030
GetExitCodeProcess.KERNEL32 ref: 00007FF64B8F504B
CloseHandle.KERNEL32 ref: 00007FF64B8F54B1
DeleteFileW.KERNEL32 ref: 00007FF64B8F54C8
GetLastError.KERNEL32 ref: 00007FF64B8F558B

Strings

Execution failure, xrefs: 00007FF64B8F4AE8
oid=%d&entry_app=%ws, xrefs: 00007FF64B8F4589, 00007FF64B8F4C33
{"app":{"%ws":{"app_status":{"name":"%ws","status":"%ws"}}}}, xrefs: 00007FF64B8F58F2
product, xrefs: 00007FF64B8F3DB6
p, xrefs: 00007FF64B8F4A47
oid=%d&entry_app=%ws&source=%ws, xrefs: 00007FF64B8F3F95
installed, xrefs: 00007FF64B8F5976
dl_start, xrefs: 00007FF64B8F3F4C
00000000-0000-0000-0000-D05099DB2397, xrefs: 00007FF64B8F3ECB
none, xrefs: 00007FF64B8F5934
{"app" : {"%ws" : {"dl_app_result" : {"name":"%ws","status" : %d}}}}, xrefs: 00007FF64B8F3F0D
exec_start, xrefs: 00007FF64B8F4BDF
@, xrefs: 00007FF64B8F4A52
h, xrefs: 00007FF64B8F4A13
https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws, xrefs: 00007FF64B8F3DF5
{"app": {"notifications": {"offerIsOpen": false}}}, xrefs: 00007FF64B8F484F
{"app":{"offer": {"offerInfo":{"oid":0,"otype":""}},"hide_window":"offer"}}, xrefs: 00007FF64B8F4806
dl_successful, xrefs: 00007FF64B8F4540
delete_error, xrefs: 00007FF64B8F54E6
exec_end, xrefs: 00007FF64B8F5062
eC=%d&oid=%d&entry_app=%ws, xrefs: 00007FF64B8F552F
oid=%d&entry_app=%ws&exitCode=%d, xrefs: 00007FF64B8F50AB

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseCodeDeleteErrorExecuteExitFileHandleInitializeLastObjectProcessShellSingleWait
String ID: 00000000-0000-0000-0000-D05099DB2397$@$Execution failure$delete_error$dl_start$dl_successful$eC=%d&oid=%d&entry_app=%ws$exec_end$exec_start$h$https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws$installed$none$oid=%d&entry_app=%ws$oid=%d&entry_app=%ws&exitCode=%d$oid=%d&entry_app=%ws&source=%ws$p$product${"app" : {"%ws" : {"dl_app_result" : {"name":"%ws","status" : %d}}}}${"app": {"notifications": {"offerIsOpen": false}}}${"app":{"%ws":{"app_status":{"name":"%ws","status":"%ws"}}}}${"app":{"offer": {"offerInfo":{"oid":0,"otype":""}},"hide_window":"offer"}}
API String ID: 1332431403-54875173
Opcode ID: 657389c0280514427f384ae410d1dae63ec4c2c9a18621aef96b12ae14c2aa32
Instruction ID: 434d40db01d2bee868b34267abbf4374ea8e7ac4c60f5cc8556cce5999ec0e99
Opcode Fuzzy Hash: 657389c0280514427f384ae410d1dae63ec4c2c9a18621aef96b12ae14c2aa32
Instruction Fuzzy Hash: 1803B33261DBC599DA70AB14E8902EBB3A5FBC9740F405126E6CD83B6AEF3CD554CB40

Function 00007FF64B8BB130 Relevance: 46.1, APIs: 12, Strings: 14, Instructions: 636
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExW.USER32 ref: 00007FF64B8BB230
CreateWindowExW.USER32 ref: 00007FF64B8BB31B

Strings

P, xrefs: 00007FF64B8BB190
ENDING_EVT_HANDLER, xrefs: 00007FF64B8BB14D
shutdown, xrefs: 00007FF64B8BB97E
product, xrefs: 00007FF64B8BBA8E
PCAppStore, xrefs: 00007FF64B8BB439
system_event, xrefs: 00007FF64B8BBAD0
msg=shutdown, xrefs: 00007FF64B8BB754
Local, xrefs: 00007FF64B8BB3F7
system_event, xrefs: 00007FF64B8BB712
product, xrefs: 00007FF64B8BB6D0
msg=logoff, xrefs: 00007FF64B8BBB12
logoff, xrefs: 00007FF64B8BBD35
Windows Default Lock Screen, xrefs: 00007FF64B8BB3DB
{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}, xrefs: 00007FF64B8BBEAA

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ClassCreateRegisterWindow
String ID: ENDING_EVT_HANDLER$Local$P$PCAppStore$Windows Default Lock Screen$logoff$msg=logoff$msg=shutdown$product$product$shutdown$system_event$system_event${"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}
API String ID: 3469048531-4236414880
Opcode ID: e3db5f2ec02d19e999b21b8d76df27be58171ed9378f3000db9257bc34c37085
Instruction ID: 2f9211730d23d24860150b4df34f15417f8376b36ab493a56cab31d88eea8d1e
Opcode Fuzzy Hash: e3db5f2ec02d19e999b21b8d76df27be58171ed9378f3000db9257bc34c37085
Instruction Fuzzy Hash: E672C53261DBC195EA71BB24E4903EAA365FBC9740F405136E68D83BAAEF3CD554CB40

Function 00007FF64B8BC290 Relevance: 32.9, APIs: 5, Strings: 13, Instructions: 1383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ui_creation_error, xrefs: 00007FF64B8BC359
waiting_for_UI_connection, xrefs: 00007FF64B8BC398
windows_created, xrefs: 00007FF64B8BC416
product, xrefs: 00007FF64B8BC2DB
started, xrefs: 00007FF64B8BC31A
{"app" : {"show_window":"main"}}, xrefs: 00007FF64B8BD879
ui_closing_failed, xrefs: 00007FF64B8BDD2F
product, xrefs: 00007FF64B8BDA8B
ui_closing_timeout, xrefs: 00007FF64B8BDACA
ui_not_found, xrefs: 00007FF64B8BDF5B
prnt=%ws&sys_lang=%ws, xrefs: 00007FF64B8BC53B
{"app": {"init": {"engineInit": true}}}, xrefs: 00007FF64B8BC49B
waiting_for_windows_creation, xrefs: 00007FF64B8BC3D7

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Name$CloseDefaultFileLanguageLocaleModuleOpenUserValue
String ID: prnt=%ws&sys_lang=%ws$product$product$started$ui_closing_failed$ui_closing_timeout$ui_creation_error$ui_not_found$waiting_for_UI_connection$waiting_for_windows_creation$windows_created${"app" : {"show_window":"main"}}${"app": {"init": {"engineInit": true}}}
API String ID: 3003830863-622979156
Opcode ID: 0195e5e4fc49e5d8400b13b120f7d5bb36dcb4d9815857f99ddee508b2439eee
Instruction ID: 15101d50fb0a6e0c11088be6fcbc9147cafc22958049185b7bb9802b1e154eac
Opcode Fuzzy Hash: 0195e5e4fc49e5d8400b13b120f7d5bb36dcb4d9815857f99ddee508b2439eee
Instruction Fuzzy Hash: 47F2EB3260DEC195DA70BB24E4913EBA364FBC9780F401536E68D87BAAEE2CD555CB40

Function 00007FF64B8BE340 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 302
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32 ref: 00007FF64B8BE3E6
PostQuitMessage.USER32 ref: 00007FF64B8BE9BC
DefWindowProcW.USER32 ref: 00007FF64B8BE9E4
DefWindowProcW.USER32 ref: 00007FF64B8BEA0B

Strings

product, xrefs: 00007FF64B8BE444
product, xrefs: 00007FF64B8BE6FC
system_event, xrefs: 00007FF64B8BE483
msg=suspend, xrefs: 00007FF64B8BE4C2
system_event, xrefs: 00007FF64B8BE73E
msg=resume_suspend, xrefs: 00007FF64B8BE77D

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: MessagePostProcWindow$Quit
String ID: msg=resume_suspend$msg=suspend$product$product$system_event$system_event
API String ID: 3552470998-2520652036
Opcode ID: 3a5b2b2766910286d68f0c31224ade0bbce32a53d470bd98d0ac6cfde111d970
Instruction ID: 4e6ed137931727faf56b68d61256277a9b7d01801aee1260ccc647e3e85bc4c7
Opcode Fuzzy Hash: 3a5b2b2766910286d68f0c31224ade0bbce32a53d470bd98d0ac6cfde111d970
Instruction Fuzzy Hash: 76F1C73251DBC699EA71BB24E4803EAB3A4FBC9340F405536EA8D86B69DF3CD554CB40

Function 00007FF64B8FBE70 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 264
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpConnect.WINHTTP ref: 00007FF64B8FBF43
GetTickCount64.KERNEL32 ref: 00007FF64B8FBF6E
WinHttpOpenRequest.WINHTTP ref: 00007FF64B8FC3BE
WinHttpSetTimeouts.WINHTTP ref: 00007FF64B8FC3EF
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FC406
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FC41A
WinHttpSendRequest.WINHTTP ref: 00007FF64B8FC47B
WinHttpReceiveResponse.WINHTTP ref: 00007FF64B8FC493
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FC4AA
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FC4BE

Strings

GET, xrefs: 00007FF64B8FC3B2

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Http$CloseHandle$Request$ConnectCount64OpenReceiveResponseSendTickTimeouts
String ID: GET
API String ID: 648938436-1805413626
Opcode ID: aca000783c53d5a508a98d6040bb6e3a7e78a38913e3af21ed66d760a6f833b0
Instruction ID: 29d6c64d617ad653f09c8a18e5996926a88a1c4bc8fb986bc943644d3af7150e
Opcode Fuzzy Hash: aca000783c53d5a508a98d6040bb6e3a7e78a38913e3af21ed66d760a6f833b0
Instruction Fuzzy Hash: DDF15F3660DFC589D6B0AB56F8843AAB3A4F799794F104126DACD83B69DF7CD094CB00

Function 00007FF64BA64210 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FF64BA64324

Part of subcall function 00007FF64BA60210: CreateEventW.KERNEL32 ref: 00007FF64BA60238

Strings

ClosingEvent, xrefs: 00007FF64BA64294
ColorPrevalence, xrefs: 00007FF64BA6444F
EnableTransparency, xrefs: 00007FF64BA6448E
ColorizationColor, xrefs: 00007FF64BA64410
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF64BA643D1
SystemUsesLightTheme, xrefs: 00007FF64BA644CD
Software\Microsoft\Windows\DWM, xrefs: 00007FF64BA6438F
TaskbarAl, xrefs: 00007FF64BA6451D
Software\Microsoft\Windows\CurrentVersion\Themes\Personalize, xrefs: 00007FF64BA64350

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CreateEvent
String ID: ClosingEvent$ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl
API String ID: 2692171526-2470191940
Opcode ID: 83cde789d96aa9074cbefad66f4ce03e7f5f2f04262af3f40ef153ca526d3072
Instruction ID: ca8b9ea4d057823dab5fb93f850507b18278131bf525f7b40082d5216e8aa98b
Opcode Fuzzy Hash: 83cde789d96aa9074cbefad66f4ce03e7f5f2f04262af3f40ef153ca526d3072
Instruction Fuzzy Hash: 7352923661DBC595DAB1AB15E8903DBB3A4FBC9780F401126EACC83B69EF38D554CB40

Function 00007FF64B8B97D0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF64B8B9ADD
GetWindowTextW.USER32 ref: 00007FF64B8B9AFC
EnumChildWindows.USER32 ref: 00007FF64B8B9C1D
EnumChildWindows.USER32 ref: 00007FF64B8B9C38
EnumChildWindows.USER32 ref: 00007FF64B8B9C53

Strings

Shell_TrayWnd, xrefs: 00007FF64B8B97FA
Start, xrefs: 00007FF64B8B9879
TrayButton, xrefs: 00007FF64B8B9980
TrayDummySearchControl, xrefs: 00007FF64B8B98FB
=====> %ws FOUND <=====, xrefs: 00007FF64B8B9A05

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ChildEnumWindows$ClassNameTextWindow
String ID: =====> %ws FOUND <=====$Shell_TrayWnd$Start$TrayButton$TrayDummySearchControl
API String ID: 1800985010-2840285642
Opcode ID: d33b9d749b3fb51d0582b3a0a45378c842a85a664efe6ee0f4cf09bbfba76665
Instruction ID: 1e12bb3535178c9073ca840356200d41319e52095928865e5dc17d818c016293
Opcode Fuzzy Hash: d33b9d749b3fb51d0582b3a0a45378c842a85a664efe6ee0f4cf09bbfba76665
Instruction Fuzzy Hash: 8732E93261DAC199E6B1BB60E4513EBB3A4FBD9740F401136E68DC6AAADF3CD544CB40

Function 00007FF64B95C300 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 00007FF64B95C375
VerQueryValueW.VERSION ref: 00007FF64B95C404
wsprintfW.USER32 ref: 00007FF64B95C447
wsprintfW.USER32 ref: 00007FF64B95C486
VerQueryValueW.VERSION ref: 00007FF64B95C4A1
VerQueryValueW.VERSION ref: 00007FF64B95C4D4
GlobalFree.KERNEL32 ref: 00007FF64B95C4F5

Strings

\StringFileInfo\%04x%04x\FileDescription, xrefs: 00007FF64B95C43B
\VarFileInfo\Translation, xrefs: 00007FF64B95C3F8
\StringFileInfo\%04x%04x\ProductVersion, xrefs: 00007FF64B95C477

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: QueryValue$Globalwsprintf$AllocFree
String ID: \StringFileInfo\%04x%04x\FileDescription$\StringFileInfo\%04x%04x\ProductVersion$\VarFileInfo\Translation
API String ID: 839831799-227869778
Opcode ID: a9afd9cb9b9289057acc9d8dcb27ccb20bea6f7cc87a958d0be7342b61cb1e98
Instruction ID: bc1b0f72385f3ebc1c5aa09e2429027766c848196011a509b0da76f867b29a07
Opcode Fuzzy Hash: a9afd9cb9b9289057acc9d8dcb27ccb20bea6f7cc87a958d0be7342b61cb1e98
Instruction Fuzzy Hash: B0513B6261CA8692DB60FB15E0547BAA7A0FBC9784F405032EA8EC3A79DE3CD545CB00

Function 00007FF64B96B680 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 270
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 00007FF64B96BBAC
CoCreateInstance.OLE32 ref: 00007FF64B96BBDD

Strings

SearchHost.exe, xrefs: 00007FF64B96B960
explorer.exe, xrefs: 00007FF64B96B8A0
ShellExperienceHost.exe, xrefs: 00007FF64B96B861
SearchUI.exe, xrefs: 00007FF64B96B921
SearchApp.exe, xrefs: 00007FF64B96B8E2
StartMenuExperienceHost.exe, xrefs: 00007FF64B96B82B

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CreateInitializeInstance
String ID: SearchApp.exe$SearchHost.exe$SearchUI.exe$ShellExperienceHost.exe$StartMenuExperienceHost.exe$explorer.exe
API String ID: 3519745914-3335880049
Opcode ID: e9f61415fa295ad045d94bcece110d070d92e1117c06e7e255e3f311c7c8884c
Instruction ID: 197f23a50329f14ed5e07674f0eaba9ecc7270dcc0e2e9031a77a8702496ba56
Opcode Fuzzy Hash: e9f61415fa295ad045d94bcece110d070d92e1117c06e7e255e3f311c7c8884c
Instruction Fuzzy Hash: D9E1E63660DBC595DAB0AB15E4953EAB760FBC9780F409036DA8D87B6AEF3CD444CB40

Function 00007FF64BA5CD30 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE ref: 00007FF64BA5D0B8

Part of subcall function 00007FF64BA59560: SetLastError.KERNEL32 ref: 00007FF64BA59570

GetLastError.KERNEL32 ref: 00007FF64BA5D0D2

Strings

{"app" : {"menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}, xrefs: 00007FF64BA5CD9C
CoInitialize+Init+Failed, xrefs: 00007FF64BA5CF8F
{"app" : {"show_window": "menu_store","menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}, xrefs: 00007FF64BA5CE03
{"app" : {"hide_window": "menu_search"}}, xrefs: 00007FF64BA5CF0A
CoCreateInstance+CLSID_AppVisibility+IID_IAppVisibility, xrefs: 00007FF64BA5D014
{"app" : {"hide_window": "menu_store"}}, xrefs: 00007FF64BA5CE85

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorLast$CreateInstance
String ID: CoCreateInstance+CLSID_AppVisibility+IID_IAppVisibility$CoInitialize+Init+Failed${"app" : {"hide_window": "menu_search"}}${"app" : {"hide_window": "menu_store"}}${"app" : {"menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}${"app" : {"show_window": "menu_store","menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}
API String ID: 63071249-2706694235
Opcode ID: ccf33f0b89ee57e7251ad08b1552133a116e77885736e999a84b61d10f524417
Instruction ID: 9e6357b87d48194e271ba03b71fe877c3c0e5eb9673abe800bc1936c1c227ff0
Opcode Fuzzy Hash: ccf33f0b89ee57e7251ad08b1552133a116e77885736e999a84b61d10f524417
Instruction Fuzzy Hash: 37D1C532A1DAC295DA71BB14E4913EBB3A4FBC9740F404136E68D87B6AEF2CD554CB40

Function 00007FF64B8CD500 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF64B8CD606
RegOpenKeyExW.KERNEL32 ref: 00007FF64B8CD681
RegSetValueExW.KERNEL32 ref: 00007FF64B8CD6DA
RegCloseKey.ADVAPI32 ref: 00007FF64B8CD6FE

Strings

Software\PCAppStore, xrefs: 00007FF64B8CD51D
PCAppStore, xrefs: 00007FF64B8CD584
status, xrefs: 00007FF64B8CD6CE

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseFileModuleNameOpenValue
String ID: PCAppStore$Software\PCAppStore$status
API String ID: 1392962279-3586994989
Opcode ID: ac43be4d51741594d32433d1a67c776663e9781f19dead9bcbc265aa2b160293
Instruction ID: 013fc88ef857429456ac5230213cc34a55dbaa060db5476bba56c56f9c0d0e82
Opcode Fuzzy Hash: ac43be4d51741594d32433d1a67c776663e9781f19dead9bcbc265aa2b160293
Instruction Fuzzy Hash: 4D51C97261DB819AD660FB24E4913ABB764FBC9780F405136E68D83B69EF3CD544CB40

Function 00007FF64B8B16D0 Relevance: 11.3, APIs: 3, Strings: 3, Instructions: 827COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64BA5E070: CoInitializeEx.COMBASE ref: 00007FF64BA5E0E0

CreateEventW.KERNEL32 ref: 00007FF64B8B1C48

Part of subcall function 00007FF64B8B97A0: GetDesktopWindow.USER32 ref: 00007FF64B8B97A9
Part of subcall function 00007FF64B8B97A0: EnumChildWindows.USER32 ref: 00007FF64B8B97BC

CreateDirectoryW.KERNEL32 ref: 00007FF64B8B1DEF
CreateEventW.KERNEL32 ref: 00007FF64B8B1EEC

Part of subcall function 00007FF64B94C0B0: OpenEventW.KERNEL32 ref: 00007FF64B94C1D6

Strings

\download, xrefs: 00007FF64B8B1DBE
DEBUGSCREEN_EVENT, xrefs: 00007FF64B8B1E13
ClosingEvent, xrefs: 00007FF64B8B1B6F

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CreateEvent$ChildDesktopDirectoryEnumInitializeOpenWindowWindows
String ID: ClosingEvent$DEBUGSCREEN_EVENT$\download
API String ID: 1307747073-3079862309
Opcode ID: 10d413dc8df6639c5fa448d167195f6fac4a7b449c796c4a8671bd751e444177
Instruction ID: 54883770299da171391feeb8fa3da1f872f43f99a4650c8e0c3d44f6e62fc3df
Opcode Fuzzy Hash: 10d413dc8df6639c5fa448d167195f6fac4a7b449c796c4a8671bd751e444177
Instruction Fuzzy Hash: 78A2E73260DFC585DA70AB19E8953EBA364FB89785F001535DA8D87BAAEF3CD154CB00

Function 00007FF64BAE09FC Relevance: 10.6, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0A0B
FlsGetValue.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0A20
FlsSetValue.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0A41
FlsSetValue.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0A6E
FlsSetValue.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0A7F
FlsSetValue.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0A90
SetLastError.KERNEL32(?,?,00000001,00007FF64BACFE31,?,?,?,?,?,?,?,?,00007FF64BAC8BFE,?,?,?), ref: 00007FF64BAE0AAB

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: af887c8c93cbc43d96560930c8f2c244cd7476a811d161b51d2ab35d3cffc2b5
Instruction ID: 36dc3a6c637afd81219a9c0336bc81bb3839aa5a02ea31feab00c1a34df26f75
Opcode Fuzzy Hash: af887c8c93cbc43d96560930c8f2c244cd7476a811d161b51d2ab35d3cffc2b5
Instruction Fuzzy Hash: 68216A20A8C24646FA39B771D55217D62A2DF8CBB0F044634D96EC7EF6DE2CB4814320

Function 00007FF64B932F10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

SHAppBarMessage.SHELL32 ref: 00007FF64B932F3E
GetSystemMetrics.USER32 ref: 00007FF64B932F56
GetSystemMetrics.USER32 ref: 00007FF64B932F6D
SHAppBarMessage.SHELL32 ref: 00007FF64B932F81
SHAppBarMessage.SHELL32 ref: 00007FF64B932F99

Strings

0, xrefs: 00007FF64B932F27

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Message$MetricsSystem
String ID: 0
API String ID: 2388057244-4108050209
Opcode ID: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
Instruction ID: 01da615f620021cbadbf4cde6ca75d2267c33d3b04439cfb2bea1be9ccbdae18
Opcode Fuzzy Hash: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
Instruction Fuzzy Hash: 3E01EC7261C7448BE764AF20E55836AB7A1F78E744F405139E68E46BA8DFBDC508CF00

Function 00007FF64B95BBA0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35f4f34488456ced0f6fb02eac88d527095ed97f95edaff96465174b2413dc9
Instruction ID: b5e6348118249719f3ab8d0865d9a20f9d1b79043d271615cfbfa86169437b6d
Opcode Fuzzy Hash: e35f4f34488456ced0f6fb02eac88d527095ed97f95edaff96465174b2413dc9
Instruction Fuzzy Hash: B7C1E87260DA8595DA60FB25E4403EAB7A0FBCA790F504136E69D83BBADF7CD544CB00

Function 00007FF64B8C62C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF64B8C643E
RegQueryValueExW.KERNEL32 ref: 00007FF64B8C64F7
RegCloseKey.ADVAPI32 ref: 00007FF64B8C6523

Strings

status, xrefs: 00007FF64B8C6340
Software\PCAppStore, xrefs: 00007FF64B8C62D9

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\PCAppStore$status
API String ID: 3677997916-3794422696
Opcode ID: efb4bfaf69d025b927c3919d006ab5e97d401c4810abae94c0a9b080d379a66f
Instruction ID: 93ae8b75dd4c830feaf83e1c8cafe39ccf9976b03139c69cb3e920935ac8a800
Opcode Fuzzy Hash: efb4bfaf69d025b927c3919d006ab5e97d401c4810abae94c0a9b080d379a66f
Instruction Fuzzy Hash: BF61A43261DAC199DA60AB14E4913EBB3A4FBC9780F405136E68D83BA9EF3CD554CB40

Function 00007FF64BAE5434 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b4d00dbc8388a9b12d4b0d012e868a60692be70ab8a079784b9690bbb137de
Instruction ID: 5229e8de68beb36139616088a1cf82657de34075f8cd5f42979229d06f7397b3
Opcode Fuzzy Hash: d7b4d00dbc8388a9b12d4b0d012e868a60692be70ab8a079784b9690bbb137de
Instruction Fuzzy Hash: 94C1F322A4C68692E761BB15E4403BE3B61FF99B80F590131DA4E877B1DF7CE884C720

Function 00007FF64BA5E460 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 403COMMON

Download Yara Rule

Strings

Shell_TrayWnd, xrefs: 00007FF64BA5E4C8
Taskbar, xrefs: 00007FF64BA5E489

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID:
String ID: Shell_TrayWnd$Taskbar
API String ID: 0-1897506974
Opcode ID: 49de7bddd30700ffc58c29531e65d2e459041191d49c2045cd108c617bfab32f
Instruction ID: 68b94b454efa3f78ad52f2098f4fc14333e23b9e1f015894387d108dccffb6a4
Opcode Fuzzy Hash: 49de7bddd30700ffc58c29531e65d2e459041191d49c2045cd108c617bfab32f
Instruction Fuzzy Hash: 2B22D33261DA8196E660FB15E4912EAB7A0FBC9740F405536E6CDC3BAAEF3CD544CB40

Function 00007FF64BA5F970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF64BA5F992
GetSystemMetrics.USER32 ref: 00007FF64BA5F99A
GetSystemMetrics.USER32 ref: 00007FF64BA5F9A9

Part of subcall function 00007FF64B92D800: MonitorFromPoint.USER32 ref: 00007FF64B92D81E

Strings

(, xrefs: 00007FF64BA5F9B3

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: System$Metrics$FromInfoMonitorParametersPoint
String ID: (
API String ID: 865970660-3887548279
Opcode ID: 13e12977f7533f15ef69eddcbbfc0fd0c8348206ac9712c3fd55c20fe7d31477
Instruction ID: b3db1f8c96e3dd9e956934ef2aac1cb5c136cdf8403fd4debf04b4bad6ddb721
Opcode Fuzzy Hash: 13e12977f7533f15ef69eddcbbfc0fd0c8348206ac9712c3fd55c20fe7d31477
Instruction Fuzzy Hash: B631507290C685CAD765BB25E05012ABBA1FB89B94F008135E68EC3B65CF3DD6818F15

Function 00007FF64B8BAFB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32 ref: 00007FF64B8BB069
WaitForSingleObject.KERNEL32 ref: 00007FF64B8BB094
CloseHandle.KERNEL32 ref: 00007FF64B8BB0B5

Strings

ClosingEvent, xrefs: 00007FF64B8BAFC9

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseEventHandleObjectOpenSingleWait
String ID: ClosingEvent
API String ID: 1727428665-2998232585
Opcode ID: 1053212c9db2f82abfb25b38c7d15209895087dec2426bbbfa6121425564d087
Instruction ID: 0df27cd618bd68f9314e37ed73ead4fd681e794e460686a5ec3fb64e36ca2591
Opcode Fuzzy Hash: 1053212c9db2f82abfb25b38c7d15209895087dec2426bbbfa6121425564d087
Instruction Fuzzy Hash: 48313E3291CA8196E660BB21E4913ABB7A1FBC9380F505536F68D82B79DF3CD545CB00

Function 00007FF64BAE6984 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF64BAF3181), ref: 00007FF64BAE6AA0
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF64BAF3181), ref: 00007FF64BAE6B2B

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c036e56a59628b86c18341a9c02e7de676271cae1522afdd6599a2391acaaf31
Instruction ID: e1b2b39333e94dc1d7ed7dd99167fc888e5b0953689f1e333c0e5ca4c2a02c37
Opcode Fuzzy Hash: c036e56a59628b86c18341a9c02e7de676271cae1522afdd6599a2391acaaf31
Instruction Fuzzy Hash: 2991C462F4C65285F760BF69D4502BD2BA0FB49B88F584539DE0E97AA4DF38E4C1C720

Function 00007FF64BACFC38 Relevance: 6.1, APIs: 4, Instructions: 60threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF64BACFCA4
GetLastError.KERNEL32 ref: 00007FF64BACFCB2
CloseHandle.KERNEL32 ref: 00007FF64BACFCC8
FreeLibrary.KERNEL32 ref: 00007FF64BACFCD7

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread
String ID:
API String ID: 3065451008-0
Opcode ID: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
Instruction ID: a38273101abe66c84570872ed10ef09953d0dd3856c9ab8de125f217c2995ed0
Opcode Fuzzy Hash: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
Instruction Fuzzy Hash: C9213925B0DB8286EA15FB66E450179B3A0FF8DB84F084535EE4E83B66DF3DE4848610

Function 00007FF64B94F480 Relevance: 6.1, APIs: 4, Instructions: 60comfileCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(?,?,?,?,?,?,?,?,?,?,00007FF64B94F5EA), ref: 00007FF64B94F50E
CoInitializeSecurity.OLE32 ref: 00007FF64B94F54B
CoCreateInstance.COMBASE ref: 00007FF64B94F577
IcmpCreateFile.IPHLPAPI ref: 00007FF64B94F57D

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CreateInitialize$FileIcmpInstanceSecurity
String ID:
API String ID: 897544864-0
Opcode ID: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
Instruction ID: 6c280233aaa34dc087bdd25c06ef8a60f99f5dd1cc72793de48ee5b27f6e62b6
Opcode Fuzzy Hash: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
Instruction Fuzzy Hash: 51312432A0CB8982EB10EF26E45536E7761FB86B58F104135E99D47BA5CF3DE0448B00

Function 00007FF64B932310 Relevance: 6.1, APIs: 4, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF64B932347
RegQueryValueExW.KERNEL32 ref: 00007FF64B932392
RegCloseKey.ADVAPI32 ref: 00007FF64B9323A1
RegCloseKey.KERNEL32 ref: 00007FF64B9323CD

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$CreateQueryValue
String ID:
API String ID: 2495337196-0
Opcode ID: 96195a7c97848da1d77ab3426f6f75efb8691eeffdb334130dcc645515b0f2e7
Instruction ID: f928ba5b04e5785d5fb0867d75ca2edfa30b32ed5bd412e4fcfdaebb3ca0b369
Opcode Fuzzy Hash: 96195a7c97848da1d77ab3426f6f75efb8691eeffdb334130dcc645515b0f2e7
Instruction Fuzzy Hash: 03219A3292DB8186DA50BB25E49416FB7A4FBCA780F101036F6CE87A7ADF3CD4549B40

Function 00007FF64B9325A0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF64B9325CE
RegSetValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64B8CF86D), ref: 00007FF64B93261A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64B8CF86D), ref: 00007FF64B932629
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF64B8CF86D), ref: 00007FF64B932657

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$CreateValue
String ID:
API String ID: 1009429713-0
Opcode ID: afaa129ba2b9e17a96cafe80f4d355de79babfd96263a463f4b651ecabceec53
Instruction ID: 811d4a9e50ce79194718c2f9f9008610a7b46fee59e92fa3cab3754a7d83d80b
Opcode Fuzzy Hash: afaa129ba2b9e17a96cafe80f4d355de79babfd96263a463f4b651ecabceec53
Instruction Fuzzy Hash: 1421BB3291CA8186DA50BB26E49026FB760FBCA784F101436F6CE87A7ADF3CD4449B40

Function 00007FF64BA60E70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF64BA60F33
RegCloseKey.ADVAPI32 ref: 00007FF64BA60F6E

Strings

registry was not opened, xrefs: 00007FF64BA60F82

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseOpen
String ID: registry was not opened
API String ID: 47109696-1342567452
Opcode ID: 067907fc8f543bc1f2be4a343745e0e14ada7d80e169db747d1a2db14da4985a
Instruction ID: 4b5147dcf6a66726edb87543a152c8219592c637dcc60e083dbbbd4e142aee7f
Opcode Fuzzy Hash: 067907fc8f543bc1f2be4a343745e0e14ada7d80e169db747d1a2db14da4985a
Instruction Fuzzy Hash: CE51D57261DAC195DA60FB25E4913AAB3A0FBC9780F405036EACD83B6ADF3CD554CB00

Function 00007FF64B8FAF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63timeCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 00007FF64B8FB00E
WinHttpSetTimeouts.WINHTTP ref: 00007FF64B8FB080

Strings

WinHTTP 1.0, xrefs: 00007FF64B8FAF99

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Http$OpenTimeouts
String ID: WinHTTP 1.0
API String ID: 3926271993-2851767304
Opcode ID: 09fa952aa977d0558df61ac88b23ebaea55537f54b3a05465df767db54d51df2
Instruction ID: 3beecd452b931e737990999d09c4049a1ea8aa3e93b17f2ed46efb1a8a01687f
Opcode Fuzzy Hash: 09fa952aa977d0558df61ac88b23ebaea55537f54b3a05465df767db54d51df2
Instruction Fuzzy Hash: 4E31193262CA8186E610FB15E4807ABB7A1FBC9784F405035F68E87BA9DF7CD444CB40

Function 00007FF64B932420 Relevance: 4.6, APIs: 3, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF64B932470
RegQueryValueExW.KERNEL32 ref: 00007FF64B9324D3
RegCloseKey.KERNEL32 ref: 00007FF64B9324ED

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseCreateQueryValue
String ID:
API String ID: 4083198587-0
Opcode ID: e6e7dc30f0810ce42f1f2f62c42acde2f2de0f07fa5ec146ca2a79758df67c51
Instruction ID: fecd0676cceab9dae2a227733c5c59de45af9b3bbc40b32e00ebf3459f06ecae
Opcode Fuzzy Hash: e6e7dc30f0810ce42f1f2f62c42acde2f2de0f07fa5ec146ca2a79758df67c51
Instruction Fuzzy Hash: 0F31093261DA8186DA50FB21E4916ABB360FBC9780F505536F6CD83B6ADF3CD404CB40

Function 00007FF64BA622D0 Relevance: 4.5, APIs: 3, Instructions: 45registrywindowCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32 ref: 00007FF64BA62308
FormatMessageW.KERNEL32 ref: 00007FF64BA62353
RegCloseKey.ADVAPI32 ref: 00007FF64BA6236C

Part of subcall function 00007FF64BAC3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B8C227F), ref: 00007FF64BAC3DF0
Part of subcall function 00007FF64BAC3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B8C227F), ref: 00007FF64BAC3E31

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ChangeCloseExceptionFileFormatHeaderMessageNotifyRaiseValue
String ID:
API String ID: 2359320287-0
Opcode ID: 1d84e24ea1a41a72f41a824b2c57889b68c9d91562dae07aab841055bba38da3
Instruction ID: d8eb7eb86df8898207ca2137b246548e160298e6459e1d38f420af4713b33a78
Opcode Fuzzy Hash: 1d84e24ea1a41a72f41a824b2c57889b68c9d91562dae07aab841055bba38da3
Instruction Fuzzy Hash: 5F212C7261CA8186E720EB15E44436AB7A0F7CA788F508435E68C83BB9DF7DD549CB00

Function 00007FF64B96AB80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32 ref: 00007FF64B96AC42

Strings

DEBUGSCREEN_EVENT, xrefs: 00007FF64B96AB99

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: EventOpen
String ID: DEBUGSCREEN_EVENT
API String ID: 3658969616-491765807
Opcode ID: e9ecb541bfec36b6bd037ab5115ca9dee5ae7b67843e05f2a2d7245eaeafdd25
Instruction ID: 0c3f40c870d915a68d3a384d3d00ea888fbdd897f65f1cd9b42f473c4885c487
Opcode Fuzzy Hash: e9ecb541bfec36b6bd037ab5115ca9dee5ae7b67843e05f2a2d7245eaeafdd25
Instruction Fuzzy Hash: 0151083261DAC695DA60FB15E4913EBA360FBC9780F405036E6CD87BBADE2CD515CB40

Function 00007FF64B919C90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF64B919D5E

Strings

h, xrefs: 00007FF64B919CB8

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CreateProcess
String ID: h
API String ID: 963392458-2439710439
Opcode ID: 4425c04c5f0eedab8ae0265d447e70cf76a5286354d0daf94f6f6e9a40669210
Instruction ID: 00777c807bbb9159c4fc5763b9c2580a5e622dc9b3eef245a90145c67e2928e0
Opcode Fuzzy Hash: 4425c04c5f0eedab8ae0265d447e70cf76a5286354d0daf94f6f6e9a40669210
Instruction Fuzzy Hash: ED21C63251CA8296E750EB54E4913AFB7A0F7D9344F504039F68D82AAADFBCD558CF40

Function 00007FF64BA623C0 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32 ref: 00007FF64BA6241F
RegQueryValueExW.KERNEL32 ref: 00007FF64BA62496

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
Instruction ID: 853aa880cbb85634f07b5e8a18cfc1801b4a94274778651ac31385e0a1b83de2
Opcode Fuzzy Hash: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
Instruction Fuzzy Hash: 0321FD7262DB8186DA60AB19E48466AB3E4FB89B94F502135FACD43B78DF3CD444CF10

Function 00007FF64BAEBBCC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF64BADE092,?,?,?,00007FF64BADE586,?,?,?,?,00007FF64BAD7D64,?,?,?), ref: 00007FF64BAEBBE0
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF64BADE092,?,?,?,00007FF64BADE586,?,?,?,?,00007FF64BAD7D64,?,?,?), ref: 00007FF64BAEBC4A

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 77585319db204b116c1fc42361d63d9013bd927e5b8f2a575e04e909fa60f02f
Instruction ID: a1d953fb813fb091dbadcb2e8a83c2909d895d943839e2decf65862d30a15ee1
Opcode Fuzzy Hash: 77585319db204b116c1fc42361d63d9013bd927e5b8f2a575e04e909fa60f02f
Instruction Fuzzy Hash: 2401A511E4C75581EA20BB12E44506E6360EB5DBE0F884630DF6E53BE9DE2CE8828350

Function 00007FF64B925F00 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF64B925F27
GetFileAttributesW.KERNEL32 ref: 00007FF64B925F3D

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AttributesEnvironmentExpandFileStrings
String ID:
API String ID: 3836626501-0
Opcode ID: cf2b42f781f452ba8887e965ace6311404eaabd47bc012664cabe273c61bef76
Instruction ID: cb5cfeae3fe268fa91b9cb6c084d921e373d6f241f80c47dfd12b19ff22938a5
Opcode Fuzzy Hash: cf2b42f781f452ba8887e965ace6311404eaabd47bc012664cabe273c61bef76
Instruction Fuzzy Hash: 43F01231E2C54282E6B4B724E4457BA6250FB8A754FA40631E9ADC65E5DF2CD5458B00

Function 00007FF64BAE0DD4 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,00007FF64B8BEBA3), ref: 00007FF64BAE0DEA
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF64B8BEBA3), ref: 00007FF64BAE0DF4

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
Instruction ID: 027c5e600f8e5e9a11c5a4d3efafcae1e9cd414bf9b7c2a9f95a05b14f85161c
Opcode Fuzzy Hash: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
Instruction Fuzzy Hash: A3E01251F0D54682FE69BBF2D8555791261AF9DB40F084030D90DD3AB2EE2CA5D44250

Function 00007FF64B9517A0 Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?,?,?,00007FF64B8C95C6), ref: 00007FF64B9517B4
UpdateWindow.USER32 ref: 00007FF64B9517D3

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Window$ShowUpdate
String ID:
API String ID: 2310006639-0
Opcode ID: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
Instruction ID: dbc893cd9dfe6348693ed94a1f6ed5f522d26ee89a471513b3fc114700b05b72
Opcode Fuzzy Hash: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
Instruction Fuzzy Hash: 32E09A66A29B8582DB50AB16D89522967A0F7C9B81F459021EA4E83774DF38C4558700

Function 00007FF64B96CB80 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF64B96CB89
EnumChildWindows.USER32 ref: 00007FF64B96CB9C

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ChildDesktopEnumWindowWindows
String ID:
API String ID: 2514311848-0
Opcode ID: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
Instruction ID: 60816158375774bfbba8dbf5b448dc2b1e9f0b88ca38f542ed435b8448b8467b
Opcode Fuzzy Hash: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
Instruction Fuzzy Hash: EEC01265E1E746C1DA147B65E8991343360BF4F781FD09030C40D41A308E2C905D8B00

Function 00007FF64B8B97A0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF64B8B97A9
EnumChildWindows.USER32 ref: 00007FF64B8B97BC

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ChildDesktopEnumWindowWindows
String ID:
API String ID: 2514311848-0
Opcode ID: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
Instruction ID: ca929088cd95fb479e7586471187cfadbc8d9d2a144245ff347b12292e5edf04
Opcode Fuzzy Hash: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
Instruction Fuzzy Hash: 53C01265E1E706C1DA147F75F8991343360FF5F781FD09030C40D41A308E2C9059CB00

Function 00007FF64B91C490 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetWindowTextW.USER32 ref: 00007FF64B91C4C6

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 0cf2a0489d4b6d7020a5c22c37947fe0ccb033086997616492718bf81921ff99
Instruction ID: 3f92ea821ce34398ba377f7fbe64b1754ea31906aa9b8ad8fcfd56a9df8e8f83
Opcode Fuzzy Hash: 0cf2a0489d4b6d7020a5c22c37947fe0ccb033086997616492718bf81921ff99
Instruction Fuzzy Hash: E241FB3261CA818AE660FB25E4513ABB7A5FBC9384F401136E6CDC6AA9DF7CD504CF00

Function 00007FF64B8FB0C0 Relevance: 1.6, APIs: 1, Instructions: 78synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF64B8FB1E7

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 663fe9c381e483fa1501adddf12d36106911a8cdb38d341f4e397698b9c45a6a
Instruction ID: 6464c297fd4ce4f06bee180f80dbab41a963f88040ddc8ff9d2c5a783574fa6e
Opcode Fuzzy Hash: 663fe9c381e483fa1501adddf12d36106911a8cdb38d341f4e397698b9c45a6a
Instruction Fuzzy Hash: BA314161E0C68687EE20BB29E44527E63A2FFC9784F500535EA8D877B6DE3CD5528B04

Function 00007FF64BA60210 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF64BA60238

Part of subcall function 00007FF64BA622D0: RegNotifyChangeKeyValue.KERNEL32 ref: 00007FF64BA62308
Part of subcall function 00007FF64BA622D0: FormatMessageW.KERNEL32 ref: 00007FF64BA62353
Part of subcall function 00007FF64BA622D0: RegCloseKey.ADVAPI32 ref: 00007FF64BA6236C

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ChangeCloseCreateEventFormatMessageNotifyValue
String ID:
API String ID: 3644647982-0
Opcode ID: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
Instruction ID: 913d80ad25a8ac3629e6a7ac426901787bae0aef1c12eada693efd4ab5c64700
Opcode Fuzzy Hash: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
Instruction Fuzzy Hash: 5331C47661DB8585DAA0EB29F88439FB7A0F7D8780F105126EACD83B69DF3CD0558B40

Function 00007FF64BA5E070 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 00007FF64BA5E0E0

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
Instruction ID: 2d3288ad280357b9e153a770748784fd055d890f875d7dd284eb3954086915b2
Opcode Fuzzy Hash: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
Instruction Fuzzy Hash: D321E672A1CA4183EA10FB29E44116AB7A5FBC9794F504536EACD83B7ADF3CD1528B04

Function 00007FF64BA7CAF0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32 ref: 00007FF64BA7CB6B

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: FreeTask
String ID:
API String ID: 734271698-0
Opcode ID: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
Instruction ID: 9da58762f745cfe9ec5b2ff7136b392b9cc8209f108d499a3a3975de6a20ad96
Opcode Fuzzy Hash: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
Instruction Fuzzy Hash: 3411E97252CA45C6D720FB16F45565AB361FBC8744F401132F68D86A69DF7CD544CF40

Function 00007FF64BAE5AE0 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64BAE0E10: HeapAlloc.KERNEL32 ref: 00007FF64BAE0E4E

RtlReAllocateHeap.NTDLL(?,?,00000000,00007FF64BADA6A3,?,?,?,00007FF64BAE01A3,?,?,?,00007FF64BAE0099,?,?,?,00007FF64BAE047A), ref: 00007FF64BAE5B4D

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Heap$AllocAllocate
String ID:
API String ID: 2177240990-0
Opcode ID: d1f4e796e73a478c92420ccbb471beedb7c10c5d4cbfa91b2b710b1e4cfc076d
Instruction ID: cc48ec9081541c88eca1eed05df4be949b2dca8b3afc5b86fe56b5213b927c77
Opcode Fuzzy Hash: d1f4e796e73a478c92420ccbb471beedb7c10c5d4cbfa91b2b710b1e4cfc076d
Instruction Fuzzy Hash: 0901FB10F5C64781FAA4BB65FA5137E5191DF9D7A0F088631DD2DC66E2EE6CE8C08231

Function 00007FF64B92D800 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32 ref: 00007FF64B92D81E

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: FromMonitorPoint
String ID:
API String ID: 1566494148-0
Opcode ID: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
Instruction ID: 4929f93f993eb24a5b0e09efab68b5d3c450dd22cf3407c9db31fed1c46112ec
Opcode Fuzzy Hash: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
Instruction Fuzzy Hash: 90F0FF32928E8586D212EF24E45025BF771FFDA784F105326F28E56929DF3DD5818B40

Function 00007FF64B925FA0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SHQueryRecycleBinW.SHELL32 ref: 00007FF64B925FCC

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: QueryRecycle
String ID:
API String ID: 2469249176-0
Opcode ID: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
Instruction ID: 320ca4279e2517b5165e27ff888241f6a46944e11b9f9e527dda8d5748877b2d
Opcode Fuzzy Hash: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
Instruction Fuzzy Hash: C5F01221D1CB8A92DA95BF10E4403EA6361FB9B740FA05430E54EC29A5DF3CD5059B10

Function 00007FF64B9267B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00007FF64B9267D8

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
Instruction ID: 7c733f91d1f94976ff0f5adf61b3eb25b1e229a31fcdc3a0518a8feed6ce920a
Opcode Fuzzy Hash: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
Instruction Fuzzy Hash: D1F0FEB291C64692EB20FF14E44116ABB64F7CD398F440221E68DC6A7ADF6CD649CF00

Function 00007FF64B919BE0 Relevance: 1.5, APIs: 1, Instructions: 14comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,?,?,?,?,?,00007FF64B92D901), ref: 00007FF64B919C18

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
Instruction ID: d031431ceab356b87602d649b201016e7496741c4ecd66b6dbdce4dabd26aeb3
Opcode Fuzzy Hash: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
Instruction Fuzzy Hash: 36E05A76A18B84C2C620EB55F84005ABBA4FB9A794F504526EAC842B28CF7CC165CB40

Function 00007FF64B8BA440 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF64B8BA466

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 126b51d66330d529f4528cffcfa2f01f0942d41847845eb93ade80c07f1744cd
Instruction ID: 16a4703f6d27fa292523f4b3461577f2dbf4c9cb4b7ce77ee5b93db90578142f
Opcode Fuzzy Hash: 126b51d66330d529f4528cffcfa2f01f0942d41847845eb93ade80c07f1744cd
Instruction Fuzzy Hash: 24E0EC7290DB8181D714EB15E44435ABBB0F7C9780F508125EBCC82B38DF3CC495CA00

Function 00007FF64BAA75B8 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,00007FF64B9446AE), ref: 00007FF64BAA75BC

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
Instruction ID: a19e86fa558770fcd8bb37b6d7be5d01ccb021b2cabe2a92376dad73b0d0227c
Opcode Fuzzy Hash: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
Instruction Fuzzy Hash: 52C04814F2EA43C2E6683B629D8263212A0BB4E700F944030C118C0A60DE2CA1F68A22

Function 00007FF64BAE0D5C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF64BAE0BD6,?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0DB1

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ad3a28724de0d7eae44d08b4466c8c7512d1d24c667bf16be5eedaba0a8cd6e
Instruction ID: be62f35406559742ae41d89796a3da813a409bd732e8f4eddec85b996038d593
Opcode Fuzzy Hash: 5ad3a28724de0d7eae44d08b4466c8c7512d1d24c667bf16be5eedaba0a8cd6e
Instruction Fuzzy Hash: 5BF03714B4D60241FE687A76D8923BA52999F9DB40F184430C80EC6AE6DE1CF4C58630

Function 00007FF64BAE0E10 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF64BAE0E4E

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
Instruction ID: 24cf2462acb803f7b26dce5d11125ed91dcd85ccd49a54b48b7f8f17fb119dc5
Opcode Fuzzy Hash: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
Instruction Fuzzy Hash: 67F08C11F4D20285FA747B71E94227E5192DF8DBA0F084A34DC2EC6AE2DE2CE4C18230

Function 00007FF64B8BA4A0 Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF64B8BA4CE

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
Instruction ID: e09aa53cf134474cb4f32b909183b71ac2e935c71acc954319ec64008646ecea
Opcode Fuzzy Hash: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
Instruction Fuzzy Hash: 50D05E31A0CE8186DB20BB75E45935A6BA1FBC9368F504624E6EA4BAF4DF7CC0458B40

Function 00007FF64B8B7F00 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF64B8B7F1E

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 64d30b65498477a3495af4626b3c505657476d8f41d5f7a5527f686b3be6af0a
Instruction ID: 002e6616635cde6e95e8e71cd3b1a2f6f3dd982ec81a949c1c104e945cf04039
Opcode Fuzzy Hash: 64d30b65498477a3495af4626b3c505657476d8f41d5f7a5527f686b3be6af0a
Instruction Fuzzy Hash: 26D0C771919F80C1C604EF16F840019B7A0FBCD784F409425E68D43734CF38C0958B00

Function 00007FF64B918C10 Relevance: 1.3, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE(?,?,?,?,00007FF64B90EE13), ref: 00007FF64B918C19

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
Instruction ID: 955776a0296964a1b486cd467c9783d284046d232e98f03ad726d8f09d6a88cb
Opcode Fuzzy Hash: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
Instruction Fuzzy Hash: 89B01225D19645C1C5143B75E88A0182220B79F301FA0C030C148005208E2C40AE4B00

Non-executed Functions

Function 00007FF64B93CB80 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 321sleepfilenetworkCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00007FF64B93CE36
Sleep.KERNEL32 ref: 00007FF64B93D1A6
GetTickCount.KERNEL32 ref: 00007FF64B93D1B8
Sleep.KERNEL32 ref: 00007FF64B93D1F5
URLDownloadToFileW.URLMON ref: 00007FF64B93D241
Sleep.KERNEL32 ref: 00007FF64B93D252
DeleteFileW.KERNEL32 ref: 00007FF64B93D265

Strings

&evt_src=fa_, xrefs: 00007FF64B93CD80
&nocache=, xrefs: 00007FF64B93CE04
%s%s%s%s%s%s%s%s&%s%s%I64u, xrefs: 00007FF64B93D146
temp_event, xrefs: 00007FF64B93CBC4
&evt_action=, xrefs: 00007FF64B93CDC2
00000000-0000-0000-0000-D05099DB2397, xrefs: 00007FF64B93D137
%ws\%ws, xrefs: 00007FF64B93CCCC
&version=, xrefs: 00007FF64B93CD3E
https://pcapp.store/pixel.gif?guid=, xrefs: 00007FF64B93CCFC

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Sleep$FileTick$CountCount64DeleteDownload
String ID: %s%s%s%s%s%s%s%s&%s%s%I64u$%ws\%ws$&evt_action=$&evt_src=fa_$&nocache=$&version=$00000000-0000-0000-0000-D05099DB2397$https://pcapp.store/pixel.gif?guid=$temp_event
API String ID: 3246919792-2080569349
Opcode ID: 9cf7ce4103778ffd95a6b869b196e99e7f71f4234325332f1a56c721305aeb39
Instruction ID: aa8edd3755c76b2af763a9d6e1debfe166da6bc63e9fbbf1d8cfd32851f87263
Opcode Fuzzy Hash: 9cf7ce4103778ffd95a6b869b196e99e7f71f4234325332f1a56c721305aeb39
Instruction Fuzzy Hash: 3502A23254DBC295EA70BB14E4903EAB3A4FBC9740F405536E68D82B6AEF3CD554CB40

Function 00007FF64BAA76A8 Relevance: 25.7, APIs: 17, Instructions: 229fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF64BAA7755
GetLastError.KERNEL32 ref: 00007FF64BAA775F
FindFirstFileW.KERNEL32 ref: 00007FF64BAA7776
GetLastError.KERNEL32 ref: 00007FF64BAA7782
FindClose.KERNEL32 ref: 00007FF64BAA7790
CloseHandle.KERNEL32 ref: 00007FF64BAA7839
CloseHandle.KERNEL32 ref: 00007FF64BAA79AC

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst
String ID:
API String ID: 2606427991-0
Opcode ID: 355334dcceae02b49ab9097a0ac3bef8698e95b7cc128a7e9a7f23a438070136
Instruction ID: 3a0fc5ae3c94b71ca2fcd5c3136803011072cabae2dc1e5cc33fa87f965c66c8
Opcode Fuzzy Hash: 355334dcceae02b49ab9097a0ac3bef8698e95b7cc128a7e9a7f23a438070136
Instruction Fuzzy Hash: A2917031A0CA0246E675BB25E85467A6390EF4E7B0F144731D9BE87AF4DE3CE4858B20

Function 00007FF64BAC8CB8 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF64BAC8D31
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF64BAC8D49
RtlVirtualUnwind.KERNEL32 ref: 00007FF64BAC8D84
IsDebuggerPresent.KERNEL32 ref: 00007FF64BAC8DBD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF64BAC8DC7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF64BAC8DD2

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: eb1eff54664d364fffe93d0073cbebfe185a6b11e3a872ea97b0a0592c0c5c65
Instruction ID: ee3ae9a35273d75be8f2fc9af577f4f683a044cdbe0e302150577cc9ffab8937
Opcode Fuzzy Hash: eb1eff54664d364fffe93d0073cbebfe185a6b11e3a872ea97b0a0592c0c5c65
Instruction Fuzzy Hash: BE316132618B8185EB60EF25E8402BE73A4FB9D754F540136EA9D83BA5DF3CC595CB10

Function 00007FF64BAA1254 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64BA5DAA0: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF64BA5DAC0

GetLastError.KERNEL32 ref: 00007FF64BAA12B5
IsDebuggerPresent.KERNEL32 ref: 00007FF64BAA12CD
OutputDebugStringW.KERNEL32 ref: 00007FF64BAA12DE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF64BAA12D7

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 536e1cbde581abdcf4f6eeb0427798af8337269c14b6612caf455d91a3591f50
Instruction ID: f7f82f756f6fd852a41eaea2e5433b240d75b6a5ab10c1f7e6c2ea9b95ec2048
Opcode Fuzzy Hash: 536e1cbde581abdcf4f6eeb0427798af8337269c14b6612caf455d91a3591f50
Instruction Fuzzy Hash: 88113A32A18B42A6F714BB22E6553B933A4FF49754F404135C64DC2AA0EF3CE4B8C724

Function 00007FF64B927BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B91A6B0: GetUserDefaultUILanguage.KERNEL32 ref: 00007FF64B91A6DE
Part of subcall function 00007FF64B91A6B0: LCIDToLocaleName.KERNEL32 ref: 00007FF64B91A6FD

GetLocaleInfoEx.KERNEL32 ref: 00007FF64B927CA4
GetLocaleInfoEx.KERNEL32 ref: 00007FF64B927D24

Strings

unknown, xrefs: 00007FF64B927BFF

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Locale$Info$DefaultLanguageNameUser
String ID: unknown
API String ID: 467829892-2904991687
Opcode ID: ae1f3f86b27aa6135cee2ff20fb8959bfd4e78bfbfa72571573a6ae8d738cb51
Instruction ID: 0f536d8091d6eb768efca42c0b48ea502c32c8ba071a07dfa19d65013576c34c
Opcode Fuzzy Hash: ae1f3f86b27aa6135cee2ff20fb8959bfd4e78bfbfa72571573a6ae8d738cb51
Instruction Fuzzy Hash: 39412E3261DA8195E660FB21E4917EBB7A1FBC9780F405136E68D83BBADE2CD544CF40

Function 00007FF64BAA68B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,?,00007FF64B91598A), ref: 00007FF64BAA68D6
FormatMessageA.KERNEL32 ref: 00007FF64BAA6909

Strings

!x-sys-default-locale, xrefs: 00007FF64BAA68C9

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 86d9eb462d90a40d0ec9a479c1aed245eb1ae8251b0789d64038f46ad7eeabbd
Instruction ID: cc25281c865f193a9554137968f9ba3645be9e4c1d7156ce4df9e6b04fc769eb
Opcode Fuzzy Hash: 86d9eb462d90a40d0ec9a479c1aed245eb1ae8251b0789d64038f46ad7eeabbd
Instruction Fuzzy Hash: 7001C471B0C78182E720AB16F5547BA6791FB8D784F184035DA4986BA4CF3CD5418B10

Function 00007FF64BAC3990 Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00000001,00007FF64BAC3A91,?,?,?,?,?,?,00007FF64BAC8DFB), ref: 00007FF64BAC399B
UnhandledExceptionFilter.KERNEL32(?,?,00000001,00007FF64BAC3A91,?,?,?,?,?,?,00007FF64BAC8DFB), ref: 00007FF64BAC39A4
GetCurrentProcess.KERNEL32(?,?,00000001,00007FF64BAC3A91,?,?,?,?,?,?,00007FF64BAC8DFB), ref: 00007FF64BAC39AA

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: a9e53e6157563ca2976ececc9be293e86cc5b76dc47583f9ffc2bdc0c0cb4bbb
Instruction ID: 89ca3c31d633d19de8d71810a350323569af4db5d3c5d4d546cbf77d8269b448
Opcode Fuzzy Hash: a9e53e6157563ca2976ececc9be293e86cc5b76dc47583f9ffc2bdc0c0cb4bbb
Instruction Fuzzy Hash: A2D0C961E1C94686FB283B62ED251391221BB9FB51F081434CB0FC6B71ED3C948A8300

Function 00007FF64B926690 Relevance: 2.5, APIs: 2, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00007FF64B9265D7,?,?,?,?,00007FF64B932083,?,?,?,?,00007FF64B92EDE1), ref: 00007FF64B926699
HeapFree.KERNEL32(?,?,?,?,00007FF64B9265D7,?,?,?,?,00007FF64B932083,?,?,?,?,00007FF64B92EDE1), ref: 00007FF64B9266A8

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 1b92dd3fa47805ad4be814b7207d9e358e3daaedac0e0864920ab83c9e0d32b2
Instruction ID: b73f4b7463bf042c49b1781a3f54087de70d37bd8e38b836dc62e5256241054a
Opcode Fuzzy Hash: 1b92dd3fa47805ad4be814b7207d9e358e3daaedac0e0864920ab83c9e0d32b2
Instruction Fuzzy Hash: 3EC01211E2E682A0D908B7A2A48B09966A0EBDE340F908034E9489262A8C2C80A20E20

Function 00007FF64BAA7B24 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96deb49f9c9e0e377063350eb5d5da8a57a3189ba4225a268213569ed96476fb
Instruction ID: c71852467e505850e86c56d139034cf957798b7e5be6162bb69e9c3d0117b925
Opcode Fuzzy Hash: 96deb49f9c9e0e377063350eb5d5da8a57a3189ba4225a268213569ed96476fb
Instruction Fuzzy Hash: 16C01214F0EA82C1E9283B12E8828391260BF0FB02F846034C00C80770CE2CA1D38B20

Function 00007FF64B95D0A0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 313windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B91A0B0: AssocCreate.SHLWAPI ref: 00007FF64B91A12A

ShellExecuteW.SHELL32 ref: 00007FF64B95D144
GetLastError.KERNEL32 ref: 00007FF64B95D160
SetWindowPos.USER32 ref: 00007FF64B95D5B0
SetWindowPos.USER32 ref: 00007FF64B95D5E0
SetForegroundWindow.USER32 ref: 00007FF64B95D5EB
SetFocus.USER32 ref: 00007FF64B95D5F6
GetWindowRect.USER32 ref: 00007FF64B95D609
GetSystemMetrics.USER32 ref: 00007FF64B95D65D
GetSystemMetrics.USER32 ref: 00007FF64B95D687

Strings

C, xrefs: 00007FF64B95D5B6
, xrefs: 00007FF64B95D152
product, xrefs: 00007FF64B95D17A
showInCurrentBrowser_error, xrefs: 00007FF64B95D1BC
open, xrefs: 00007FF64B95D13B
&eCode=%lu&br=default, xrefs: 00007FF64B95D1FE

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Window$MetricsSystem$AssocCreateErrorExecuteFocusForegroundLastRectShell
String ID: $&eCode=%lu&br=default$C$open$product$showInCurrentBrowser_error
API String ID: 2513301302-685431900
Opcode ID: 7f209b68ee510be14cf23d43f075100da5d465cf85999d537a5b691567d3c9e0
Instruction ID: 351605bb344bd656571dc3798d17fd7f79db7b1047bed6b125dec4ecee393cc6
Opcode Fuzzy Hash: 7f209b68ee510be14cf23d43f075100da5d465cf85999d537a5b691567d3c9e0
Instruction Fuzzy Hash: E602F93250DAC69AE671FB24E4907EEB365FBCA340F405136D68D82AA9EF3CD544CB00

Function 00007FF64B8FC4E0 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 335timeCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 00007FF64B8FC597
WinHttpConnect.WINHTTP ref: 00007FF64B8FC64A
GetTickCount64.KERNEL32 ref: 00007FF64B8FC6A6
WinHttpOpenRequest.WINHTTP ref: 00007FF64B8FCAFC
WinHttpSetTimeouts.WINHTTP ref: 00007FF64B8FCB31
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FCB48
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FCB5C
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FCB70
WinHttpSendRequest.WINHTTP ref: 00007FF64B8FCC2D
WinHttpReceiveResponse.WINHTTP ref: 00007FF64B8FCC45
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FCC5C
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FCC70
WinHttpCloseHandle.WINHTTP ref: 00007FF64B8FCC84

Strings

GET, xrefs: 00007FF64B8FCAF0
WinHTTP 1.0, xrefs: 00007FF64B8FC501

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Http$CloseHandle$OpenRequest$ConnectCount64ReceiveResponseSendTickTimeouts
String ID: GET$WinHTTP 1.0
API String ID: 4212831979-1397384856
Opcode ID: 30a75dc3898c843e322fef78d88f2628e08c9a268069421ebfdfa7e74275caa6
Instruction ID: 3287904faed03e9606ffa82be5a3f10d4b1686b2eb2b1a01ca2013e421a8977d
Opcode Fuzzy Hash: 30a75dc3898c843e322fef78d88f2628e08c9a268069421ebfdfa7e74275caa6
Instruction Fuzzy Hash: CE12713660DBC589EAB0AB15F4943EAB3A4F789790F104126DACD83B69DF7CD194CB40

Function 00007FF64B8CBD30 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 200COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF64B8CBDA5

Part of subcall function 00007FF64B92CF90: RegOpenKeyExW.ADVAPI32 ref: 00007FF64B92D0F6
Part of subcall function 00007FF64B92CF90: RegQueryValueExW.ADVAPI32 ref: 00007FF64B92D1BA

ShellExecuteW.SHELL32 ref: 00007FF64B8CBE92
GetLastError.KERNEL32 ref: 00007FF64B8CBEA0

Strings

/init %ws /restart, xrefs: 00007FF64B8CBD54
product, xrefs: 00007FF64B8CBEC8
open, xrefs: 00007FF64B8CBE89
, xrefs: 00007FF64B8CBEAA
reload_error, xrefs: 00007FF64B8CBF07
eCode=%lu, xrefs: 00007FF64B8CBF46

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorExecuteFileLastModuleNameOpenQueryShellValue
String ID: $/init %ws /restart$eCode=%lu$open$product$reload_error
API String ID: 534767287-2650242239
Opcode ID: 1e1a69b9d5a133d9fe8e81c7137a555c9729f0ee08baec9ee7b18c0f352923dd
Instruction ID: adcd06a418981186f537a039ceed73278a16db62050b2efaf228425410a64241
Opcode Fuzzy Hash: 1e1a69b9d5a133d9fe8e81c7137a555c9729f0ee08baec9ee7b18c0f352923dd
Instruction Fuzzy Hash: 0CB1C73261DAC2A5DA70BB64E4913EAB360FBC9340F405536E68D83B7AEE7CD554CB40

Function 00007FF64BA560C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 190registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF64BA561FF
RegisterClassW.USER32 ref: 00007FF64BA5627F

Strings

StartReplace, xrefs: 00007FF64BA56193

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: StartReplace
API String ID: 1693014935-3907892786
Opcode ID: 31b5721278bc1df87b6e51de0ef8ec08d43428c1a1da8ef09b83c844a1edc353
Instruction ID: 90dfc85680dfccf4638593c96bb9a25f5b4888e1d5fc556693652091d4f76bf6
Opcode Fuzzy Hash: 31b5721278bc1df87b6e51de0ef8ec08d43428c1a1da8ef09b83c844a1edc353
Instruction Fuzzy Hash: 89A1AF3260DBC599DA61AB29E4903EAB7A5FBC9780F404136DA8D83B69DF3CD544CB40

Function 00007FF64B95CCD0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 173windowCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00007FF64B95CD39
GetLastError.KERNEL32 ref: 00007FF64B95CD4F

Part of subcall function 00007FF64B95D0A0: ShellExecuteW.SHELL32 ref: 00007FF64B95D144
Part of subcall function 00007FF64B95D0A0: GetLastError.KERNEL32 ref: 00007FF64B95D160

SetForegroundWindow.USER32 ref: 00007FF64B95D05F
SetFocus.USER32 ref: 00007FF64B95D06A

Strings

open, xrefs: 00007FF64B95CD30
product, xrefs: 00007FF64B95CD69
, xrefs: 00007FF64B95CD44
&eCode=%lu&br=%ws, xrefs: 00007FF64B95CDE7
showInCurrentBrowser_error, xrefs: 00007FF64B95CDA8

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorExecuteLastShell$FocusForegroundWindow
String ID: $&eCode=%lu&br=%ws$open$product$showInCurrentBrowser_error
API String ID: 810458230-1600046415
Opcode ID: 9017d61baae88eafe7c2001df7ab307bc4c0607bdfca28fe72645289dcbcf4ec
Instruction ID: 6632fd37bcc5f5788b3a7920ce41fb7635f599bccfa21491f19c4ddb2753ee54
Opcode Fuzzy Hash: 9017d61baae88eafe7c2001df7ab307bc4c0607bdfca28fe72645289dcbcf4ec
Instruction Fuzzy Hash: 9691C73251DAC695EA60BB24E4913EAB364FBCA340F405536E68D83B7AEF3CD554CB00

Function 00007FF64B8C3B30 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 306COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B932310: RegCreateKeyW.ADVAPI32 ref: 00007FF64B932347
Part of subcall function 00007FF64B932310: RegQueryValueExW.KERNEL32 ref: 00007FF64B932392
Part of subcall function 00007FF64B932310: RegCloseKey.ADVAPI32 ref: 00007FF64B9323A1

SetEvent.KERNEL32 ref: 00007FF64B8C4217

Strings

product, xrefs: 00007FF64B8C3DCB
exit, xrefs: 00007FF64B8C3F51
{"app" : { "close_app" : 1}}, xrefs: 00007FF64B8C3B7F
RES_COUNT, xrefs: 00007FF64B8C3C69
reload, xrefs: 00007FF64B8C3E45
reason=%ws, xrefs: 00007FF64B8C3FDB
product, xrefs: 00007FF64B8C3ED7

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseCreateEventQueryValue
String ID: RES_COUNT$exit$product$product$reason=%ws$reload${"app" : { "close_app" : 1}}
API String ID: 3402758941-3700722040
Opcode ID: f457ee87fa4d1ea962be7eac4e2d5b70498fbd24c98dbf47dca13eb6dcd315ac
Instruction ID: 94f8c0bc2538c0f8144174bdffd6e9ceff5d4c1b40db2cb1a9cf79e316634ec1
Opcode Fuzzy Hash: f457ee87fa4d1ea962be7eac4e2d5b70498fbd24c98dbf47dca13eb6dcd315ac
Instruction Fuzzy Hash: 2902B33661DBC599DA70AB25E4802EAB364FBC9740F405136EACD83B6AEF38D554CB40

Function 00007FF64B92CF90 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 140registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF64B92D0F6
RegQueryValueExW.ADVAPI32 ref: 00007FF64B92D1BA
RegCloseKey.ADVAPI32 ref: 00007FF64B92D1DE
RegCloseKey.ADVAPI32 ref: 00007FF64B92D23C
RegCloseKey.ADVAPI32 ref: 00007FF64B92D26F

Strings

AppParam, xrefs: 00007FF64B92D010
Software\PCAppStore, xrefs: 00007FF64B92CFA9
default, xrefs: 00007FF64B92D1E4

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: AppParam$Software\PCAppStore$default
API String ID: 1607946009-3084650451
Opcode ID: c2a4d91563ea0cc645b7c58ce1aac30b7a98b724c1c5adb5231d6603be1ecbfc
Instruction ID: a7195a7a23a21d42c7f9bd150a3150ede444a53df0fd7a349c434cb3a7bbdf57
Opcode Fuzzy Hash: c2a4d91563ea0cc645b7c58ce1aac30b7a98b724c1c5adb5231d6603be1ecbfc
Instruction Fuzzy Hash: E071E93251DAC199E671BB20E4913EBB764FBC9380F405536E68D83AAADF3CD544CB40

Function 00007FF64B919970 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF64B919986
CreateCompatibleDC.GDI32 ref: 00007FF64B919A23
CreateCompatibleBitmap.GDI32 ref: 00007FF64B919A48
SelectObject.GDI32 ref: 00007FF64B919A69
BitBlt.GDI32 ref: 00007FF64B919ABD
SelectObject.GDI32 ref: 00007FF64B919AD0
DeleteDC.GDI32 ref: 00007FF64B919ADB

Strings

, xrefs: 00007FF64B919A77

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CompatibleCreateObjectSelect$BitmapDelete
String ID:
API String ID: 1931044818-3916222277
Opcode ID: 35cec4d2eec9fa19ddf4e6ff6404fd960e49ea527ef232a0f76cb1028a1e667a
Instruction ID: 864281ae44897eaefcfec6a9c6bfb6adc5426ef1221d6058433db9b71f7da0ac
Opcode Fuzzy Hash: 35cec4d2eec9fa19ddf4e6ff6404fd960e49ea527ef232a0f76cb1028a1e667a
Instruction Fuzzy Hash: F941983661CB858AD760EB26F4843AAB7A1F7C9790F104125EA8D83B79DF7CD444CB00

Function 00007FF64B91BAD0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B932150: RegCreateKeyW.ADVAPI32 ref: 00007FF64B93217A
Part of subcall function 00007FF64B932150: RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,00007FF64B91BC9F), ref: 00007FF64B9321AB
Part of subcall function 00007FF64B932150: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF64B91BC9F), ref: 00007FF64B9321BA

Part of subcall function 00007FF64B932150: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF64B91BC9F), ref: 00007FF64B9321E6

RegOpenKeyExW.ADVAPI32 ref: 00007FF64B91BE1E

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run, xrefs: 00007FF64B91BB5A
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF64B91BAF3

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$CreateDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 2881815620-377293507
Opcode ID: 86197440fc59f79d379d350ca35bad24ba17f33e69b337c451b6b54877f8497e
Instruction ID: 546c5a4c06a4f65af373c160d74d4cafadec9f906da531e81d33b90174a8da59
Opcode Fuzzy Hash: 86197440fc59f79d379d350ca35bad24ba17f33e69b337c451b6b54877f8497e
Instruction Fuzzy Hash: 31C1B33261DAC199D6B0AB15E4913EBB7A4FBC9780F405126EACD83BA9DF3CD154CB40

Function 00007FF64BAE32C8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF64BAE3D14,?,?,?,?,00007FF64BADA79D,?,?,?,?,00007FF64BAA13FC), ref: 00007FF64BAE3444
GetProcAddress.KERNEL32(?,?,?,00007FF64BAE3D14,?,?,?,?,00007FF64BADA79D,?,?,?,?,00007FF64BAA13FC), ref: 00007FF64BAE3450

Strings

ext-ms-, xrefs: 00007FF64BAE33A1
api-ms-, xrefs: 00007FF64BAE338E

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: b900d435430a5f103d2c1bdfa4f2820a536f3b69551882501559dce37074e2bd
Instruction ID: 482bfa6205ab02417f92f8df268d1d1ee86e33976e08abd611a64faa32495958
Opcode Fuzzy Hash: b900d435430a5f103d2c1bdfa4f2820a536f3b69551882501559dce37074e2bd
Instruction Fuzzy Hash: 3041F721B1DA0285EB27BB16E81497922D0FF4EB90F455135DD1DC7BA4EF3CE4458720

Function 00007FF64B8CABA0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32 ref: 00007FF64B8CB15E
SetEvent.KERNEL32 ref: 00007FF64B8CB184

Part of subcall function 00007FF64B9326B0: RegCreateKeyW.ADVAPI32 ref: 00007FF64B9326ED
Part of subcall function 00007FF64B9326B0: RegSetKeyValueW.ADVAPI32 ref: 00007FF64B93275A
Part of subcall function 00007FF64B9326B0: RegCloseKey.ADVAPI32 ref: 00007FF64B932769

Part of subcall function 00007FF64B9326B0: RegCloseKey.ADVAPI32 ref: 00007FF64B9327A4

Strings

LastID, xrefs: 00007FF64B8CABE1
LastTimeContextual, xrefs: 00007FF64B8CAC47
DEBUGSCREEN_EVENT, xrefs: 00007FF64B8CB085
LastTime, xrefs: 00007FF64B8CAC14

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CloseEvent$CreateOpenValue
String ID: DEBUGSCREEN_EVENT$LastID$LastTime$LastTimeContextual
API String ID: 526177595-2236634864
Opcode ID: 08fde735a46728af729828aa718fa165d32398c21edb1049bcfa11f688156368
Instruction ID: 94c4a0216c59036ebe07edff25a63f943a5ec4527a628712ff2dddbb5962487a
Opcode Fuzzy Hash: 08fde735a46728af729828aa718fa165d32398c21edb1049bcfa11f688156368
Instruction Fuzzy Hash: F2E18D3661DFC594DAB1AB15E4803EBB3A5FBC9790F405226DACC83B69EF28D154CB40

Function 00007FF64BA56660 Relevance: 10.6, APIs: 7, Instructions: 118sleepwindowCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF64BA56690
DeleteObject.GDI32 ref: 00007FF64BA566C0
GetDC.USER32 ref: 00007FF64BA567F5
CreateCompatibleDC.GDI32 ref: 00007FF64BA56805
CreateCompatibleBitmap.GDI32 ref: 00007FF64BA5683B
SelectObject.GDI32 ref: 00007FF64BA56865
ReleaseDC.USER32 ref: 00007FF64BA5687C

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CompatibleCreateObject$BitmapDeleteReleaseSelectSleep
String ID:
API String ID: 3334454202-0
Opcode ID: 32ee0b46500626f0da7ec548e29395de13ae04f49fba90d89cdb007a3d861a92
Instruction ID: 7298e827b931ffd2083f695fb5bc6b595ed6720904cf0f810f24444ed50ca9e4
Opcode Fuzzy Hash: 32ee0b46500626f0da7ec548e29395de13ae04f49fba90d89cdb007a3d861a92
Instruction Fuzzy Hash: 92510A3660DB85C5EA60EB15E49076EA7A0F7C9B90F544131DA8E83BB8DF3CC585CB00

Function 00007FF64BAF32D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF64BAF3301
GetLastError.KERNEL32 ref: 00007FF64BAF330D
CloseHandle.KERNEL32 ref: 00007FF64BAF3325
CreateFileW.KERNEL32 ref: 00007FF64BAF3350
WriteConsoleW.KERNEL32 ref: 00007FF64BAF336F

Strings

CONOUT$, xrefs: 00007FF64BAF3331

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: eddd2493575fffd36178473db237eee3d09d9d22ae17176b1e1a4d61f485cdc8
Instruction ID: 5e39bb8b87b64cd41d3e23fec633ffa503a5d697c377a52c2b680a9956596aff
Opcode Fuzzy Hash: eddd2493575fffd36178473db237eee3d09d9d22ae17176b1e1a4d61f485cdc8
Instruction Fuzzy Hash: 82115E21A1CA4186E750BB56E844739A6A0FB9EBE4F444234EA6EC7BB4CF3CD9548740

Function 00007FF64BAA7B88 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF64BAA7BF8
MultiByteToWideChar.KERNEL32 ref: 00007FF64BAA7C96
LCMapStringEx.KERNEL32 ref: 00007FF64BAA7CFF
LCMapStringEx.KERNEL32 ref: 00007FF64BAA7D51
LCMapStringEx.KERNEL32 ref: 00007FF64BAA7DF6
WideCharToMultiByte.KERNEL32 ref: 00007FF64BAA7E50

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: b6b862448baebf1a13a4e74f695d7dd3fded44265ae353c1136d9be3a601d1a2
Instruction ID: 6c5f35b9888aad5554bb3b3cc17d07f9a13ec12af1259f61b90cebe44bc5a5be
Opcode Fuzzy Hash: b6b862448baebf1a13a4e74f695d7dd3fded44265ae353c1136d9be3a601d1a2
Instruction Fuzzy Hash: 93818172A0C74286EB20BF21E54027A72A5FB5C7E4F144635EA5D87BE4DF3CD8858B20

Function 00007FF64B8B6040 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 394windowCOMMON

Download Yara Rule

APIs

SHAppBarMessage.SHELL32 ref: 00007FF64B8B6288

Strings

system_panel_not_found, xrefs: 00007FF64B8B60B2
product, xrefs: 00007FF64B8B6073, 00007FF64B8B62EF, 00007FF64B8B66DC
startbutton_skip_win11_autohide_panel, xrefs: 00007FF64B8B6331
start_button_not_created, xrefs: 00007FF64B8B671E

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Message
String ID: product$start_button_not_created$startbutton_skip_win11_autohide_panel$system_panel_not_found
API String ID: 2030045667-76959595
Opcode ID: e09413c9c0398569065c9b378703c3e2c0925f81e9efc9774f6fc570466bbe60
Instruction ID: 4b9bec0a6a0463c47a236c90dd2ff9abc061a9efa3bd7a971ab9de8bfbf76aa5
Opcode Fuzzy Hash: e09413c9c0398569065c9b378703c3e2c0925f81e9efc9774f6fc570466bbe60
Instruction Fuzzy Hash: 2722B63261DAC6A5DA70FB24E4913EAB365FBC9340F405536E68D83B7AEE2CD554CB00

Function 00007FF64BAE0B74 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0B83
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0BB9
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0BE6
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0BF7
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0C08
SetLastError.KERNEL32(?,?,?,00007FF64BAC90F9,?,?,?,?,00007FF64BAE0E08), ref: 00007FF64BAE0C23

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 05bacbead67eac003dacf3f6a597402e38fafda3a838cea5dbc72c3fab741a24
Instruction ID: a4ca9bfbe2a40ebaeaa43d3e1632dcd2e44a3c54a6db5335bbb54f293f9f8198
Opcode Fuzzy Hash: 05bacbead67eac003dacf3f6a597402e38fafda3a838cea5dbc72c3fab741a24
Instruction Fuzzy Hash: BA115B20A8C68246FA29B771D54217D61A2EF8C7B0F040734D96ED7EF6DE6CA4814321

Function 00007FF64BAD611C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 00007FF64BAD6171
GetLastError.KERNEL32 ref: 00007FF64BAD617B

Part of subcall function 00007FF64BAD6058: GetCurrentDirectoryW.KERNEL32(?,?,?,00007FF64BAD61C6), ref: 00007FF64BAD6071
Part of subcall function 00007FF64BAD6058: GetLastError.KERNEL32(?,?,?,00007FF64BAD61C6), ref: 00007FF64BAD607D

SetEnvironmentVariableW.KERNEL32 ref: 00007FF64BAD6222
GetLastError.KERNEL32 ref: 00007FF64BAD622C

Strings

:, xrefs: 00007FF64BAD621A

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory$EnvironmentVariable
String ID: :
API String ID: 2281059536-336475711
Opcode ID: d600da2b7ed45aebc6d37c01417ccafd84ba126fbeceaa31be6a12e66bed1db2
Instruction ID: 1bd8e98ad2dd6f826625229de36cc0a57b294287f25d03839864f010e08db2d9
Opcode Fuzzy Hash: d600da2b7ed45aebc6d37c01417ccafd84ba126fbeceaa31be6a12e66bed1db2
Instruction Fuzzy Hash: F2417136A0C78185E760BB65F44027E77A9FB5D790F440136EE8D83AA5DF3CE4858720

Function 00007FF64B8B5A50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF64B8B5B4C
PostMessageW.USER32 ref: 00007FF64B8B5B67

Strings

, xrefs: 00007FF64B8B5A7A

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-3916222277
Opcode ID: 7bee137265fb5014d2b543f6e157df9520fbe0187814ba912f6c14cf2ca86a50
Instruction ID: 3ef2398b26578f898864b2f5ba3cdb3ffc771b74384b1b77e61fe83124713146
Opcode Fuzzy Hash: 7bee137265fb5014d2b543f6e157df9520fbe0187814ba912f6c14cf2ca86a50
Instruction Fuzzy Hash: 24312F3261C7558AE720AF65E49537A73A0FB8E785F500536FA8D87BA9CF3CD1018B44

Function 00007FF64BA5F8B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64B92D800: MonitorFromPoint.USER32 ref: 00007FF64B92D81E

SHAppBarMessage.SHELL32 ref: 00007FF64BA5F8FD
GetSystemMetrics.USER32 ref: 00007FF64BA5F915
SHAppBarMessage.SHELL32 ref: 00007FF64BA5F939
SHAppBarMessage.SHELL32 ref: 00007FF64BA5F959

Strings

0, xrefs: 00007FF64BA5F8CF

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Message$FromMetricsMonitorPointSystem
String ID: 0
API String ID: 3043705201-4108050209
Opcode ID: b1cef08877c957b104a08cd9897fa60d020e7807a6ff63bc0b0519007cdeadc3
Instruction ID: 951ed37f66993adf3c2d585d989fda1f71a48c332f579565bca85d5cf55444fa
Opcode Fuzzy Hash: b1cef08877c957b104a08cd9897fa60d020e7807a6ff63bc0b0519007cdeadc3
Instruction Fuzzy Hash: 1A11FE7260C7448BE3259F28E15422BBBB1F78E794F504229E78A82A68DF7DD5848F00

Function 00007FF64BAA63FC Relevance: 7.6, APIs: 5, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF64BAA646D
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF64BAA1A82,?,?,?,00007FF64B8AD659), ref: 00007FF64BAA648C
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF64BAA1A82,?,?,?,00007FF64B8AD659), ref: 00007FF64BAA64AE
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF64BAA1A82,?,?,?,00007FF64B8AD659), ref: 00007FF64BAA64EF
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF64BAA1A82,?,?,?,00007FF64B8AD659), ref: 00007FF64BAA6507

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: c59fc74e2d5658a353b51ebe52c1d3597eed8c2644b95b3dcce62e6eea2e3444
Instruction ID: 55c9127f0edc3dca341e5eba6f94f8b611d7b4c50c32d1f57c79e92c579a26ea
Opcode Fuzzy Hash: c59fc74e2d5658a353b51ebe52c1d3597eed8c2644b95b3dcce62e6eea2e3444
Instruction Fuzzy Hash: C6410932A1C60786EB64BF28E55427973A0FB5DB44F584035D64DC26A8DF3DE895CF20

Function 00007FF64BAA73C8 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF64BAA7423
WideCharToMultiByte.KERNEL32 ref: 00007FF64BAA746D
GetLastError.KERNEL32 ref: 00007FF64BAA747B
WideCharToMultiByte.KERNEL32 ref: 00007FF64BAA74AF
GetLastError.KERNEL32 ref: 00007FF64BAA74BD

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 9a3bdcf3b161a89a23fbfc69f3bec4ddc1baeb67bc2e78718522a19521a8a6aa
Instruction ID: 52443f2ad444c1a9db6e01f7f64efa3fcf32324c44986519dfb5b65b75bcfd20
Opcode Fuzzy Hash: 9a3bdcf3b161a89a23fbfc69f3bec4ddc1baeb67bc2e78718522a19521a8a6aa
Instruction Fuzzy Hash: 4E317E3291CA468BE320AF11E44472FBAA4F78DB94F200139EB8987A64CF3DD8458F50

Function 00007FF64BAE0C3C Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF64BAC8C47,?,?,00000000,00007FF64BAC8EE2,?,?,?,?,?,00007FF64BAC8E6E), ref: 00007FF64BAE0C5B
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC8C47,?,?,00000000,00007FF64BAC8EE2,?,?,?,?,?,00007FF64BAC8E6E), ref: 00007FF64BAE0C7A
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC8C47,?,?,00000000,00007FF64BAC8EE2,?,?,?,?,?,00007FF64BAC8E6E), ref: 00007FF64BAE0CA2
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC8C47,?,?,00000000,00007FF64BAC8EE2,?,?,?,?,?,00007FF64BAC8E6E), ref: 00007FF64BAE0CB3
FlsSetValue.KERNEL32(?,?,?,00007FF64BAC8C47,?,?,00000000,00007FF64BAC8EE2,?,?,?,?,?,00007FF64BAC8E6E), ref: 00007FF64BAE0CC4

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d0d4842443358ad62f2a13882dd4bdfab5b0675436308f08ac3345522d496841
Instruction ID: 50dd18f9ba8bfc9962b3859f0d7e9294ea76708f188f4e523deda2d61fd0d467
Opcode Fuzzy Hash: d0d4842443358ad62f2a13882dd4bdfab5b0675436308f08ac3345522d496841
Instruction Fuzzy Hash: 52115960A8C24245FA69B371D54217D21A1DF8C7B0F085336E97ED6AF6DE2CE8C18321

Function 00007FF64BAE0AD0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF64BACFE31), ref: 00007FF64BAE0AE1
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF64BACFE31), ref: 00007FF64BAE0B00
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF64BACFE31), ref: 00007FF64BAE0B28
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF64BACFE31), ref: 00007FF64BAE0B39
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF64BACFE31), ref: 00007FF64BAE0B4A

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: af4241341766ce2e9e1be7036f6381574fa78b8e43e288db0333d41a38b6a67d
Instruction ID: d0ac0d8b50c6bc60d194dc60a7c12a9de81eef9cb44efcef47b894badb692c61
Opcode Fuzzy Hash: af4241341766ce2e9e1be7036f6381574fa78b8e43e288db0333d41a38b6a67d
Instruction Fuzzy Hash: 5F11E560A8D24746F979B271D4521BD3192DF8D774F181734D93EDAAF2ED2CB8C14221

Function 00007FF64B949560 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SHAppBarMessage.SHELL32 ref: 00007FF64B9495D0
SHAppBarMessage.SHELL32 ref: 00007FF64B949698

Strings

0, xrefs: 00007FF64B949615
0, xrefs: 00007FF64B94959F

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Message
String ID: 0$0
API String ID: 2030045667-203156872
Opcode ID: 6caa16854a35b4badb024bad1baed7d586a18f4617ca1ba13612c32c3a01b98f
Instruction ID: 6e40fc7c62726c184f7f3af68d2238684429dea62cf6209ce90ca118b1507c0b
Opcode Fuzzy Hash: 6caa16854a35b4badb024bad1baed7d586a18f4617ca1ba13612c32c3a01b98f
Instruction Fuzzy Hash: 4B31E636608B889ADB61DB15E45439AB7A5F79D7D0F804435EA8D83B68EF7CC648CB00

Function 00007FF64B949410 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73windowCOMMON

Download Yara Rule

APIs

SHAppBarMessage.SHELL32 ref: 00007FF64B949499

Part of subcall function 00007FF64B949260: SHAppBarMessage.SHELL32 ref: 00007FF64B949297

Part of subcall function 00007FF64B9491E0: GetWindowRect.USER32 ref: 00007FF64B9491FD
Part of subcall function 00007FF64B9491E0: MonitorFromRect.USER32 ref: 00007FF64B94920D
Part of subcall function 00007FF64B9491E0: GetMonitorInfoW.USER32 ref: 00007FF64B94922A

SHAppBarMessage.SHELL32 ref: 00007FF64B949530

Strings

0, xrefs: 00007FF64B9494B0
0, xrefs: 00007FF64B949445

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Message$MonitorRect$FromInfoWindow
String ID: 0$0
API String ID: 3203973389-203156872
Opcode ID: bf1010573e3f3a245d3de0730b3cbbcce06f9b06f91d180bbfb8da37b1fbff6b
Instruction ID: b0e946a2e1c0338f8aaa054afd7ab3d55b7d202ad28954034c45014974f769a5
Opcode Fuzzy Hash: bf1010573e3f3a245d3de0730b3cbbcce06f9b06f91d180bbfb8da37b1fbff6b
Instruction Fuzzy Hash: 0E31EC36619B8886DB60DB59F49435AB7A5F7C9BC0F904026EB8D83B68DF7CC545CB00

Function 00007FF64B9491E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF64B9491FD
MonitorFromRect.USER32 ref: 00007FF64B94920D
GetMonitorInfoW.USER32 ref: 00007FF64B94922A

Strings

(, xrefs: 00007FF64B949218

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: MonitorRect$FromInfoWindow
String ID: (
API String ID: 2740140340-3887548279
Opcode ID: c0da5ba939e15d805878956d32222060a52adf0d43ead3bad2df4335e0b549e8
Instruction ID: c0f3ae2c5c567e7a0ddf93a7d816cc01f3b154dc7f4d79c3b063e12d53590549
Opcode Fuzzy Hash: c0da5ba939e15d805878956d32222060a52adf0d43ead3bad2df4335e0b549e8
Instruction Fuzzy Hash: 6AF0EC3660CB8496DA60EB14F84425AA760F7C8794F808531EACE83B38DF7CC549CB00

Function 00007FF64BAE5FC4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF64BAE6043
WriteFile.KERNEL32 ref: 00007FF64BAE630B
WriteFile.KERNEL32 ref: 00007FF64BAE6351
GetLastError.KERNEL32 ref: 00007FF64BAE6407

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 7b92207ffa09cd611185d3f0f1fec775b0867889f212acbfde8ee77df41c9b1b
Instruction ID: 72b4e809c7008ec3a03185240a75dc44baf1722600159bb7623aa563073e420e
Opcode Fuzzy Hash: 7b92207ffa09cd611185d3f0f1fec775b0867889f212acbfde8ee77df41c9b1b
Instruction Fuzzy Hash: 42D10232B0CA818AE751EF79D5502AC37B1FB48798B484236CE5DD7BA9DE38E446C310

Function 00007FF64B8C9DD0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF64B8C9DFD

Strings

taskbar_handler_error, xrefs: 00007FF64B8C9E47
eCode=%lu, xrefs: 00007FF64B8C9E83
product, xrefs: 00007FF64B8C9E14

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorLast
String ID: eCode=%lu$product$taskbar_handler_error
API String ID: 1452528299-2493891406
Opcode ID: bf1dee13a2de0d83039dffb54421890ec699be2e45828ffa472cfa5b92ac9f2d
Instruction ID: 30db0b0928afea8851201ce20fde24fcbf4c2bbfd5bcc7507fea3e0b4894527f
Opcode Fuzzy Hash: bf1dee13a2de0d83039dffb54421890ec699be2e45828ffa472cfa5b92ac9f2d
Instruction Fuzzy Hash: E361F83260DAC6A5DA60BB24E4413EAB361FBC9340F405436E6CD83B7AEE3CD559CB00

Function 00007FF64B9326B0 Relevance: 6.1, APIs: 4, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF64B9326ED
RegSetKeyValueW.ADVAPI32 ref: 00007FF64B93275A
RegCloseKey.ADVAPI32 ref: 00007FF64B932769
RegCloseKey.ADVAPI32 ref: 00007FF64B9327A4

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$CreateValue
String ID:
API String ID: 1009429713-0
Opcode ID: 66c319f06b97a823e13bc55fe4e69eeb30db10a938984ddfb1fea882df6ec81d
Instruction ID: c837a3e91808d387430bbf664a0e28e703b130db4fe6c43b39159fdda819290a
Opcode Fuzzy Hash: 66c319f06b97a823e13bc55fe4e69eeb30db10a938984ddfb1fea882df6ec81d
Instruction Fuzzy Hash: 9B31FB3291DA8186E650FB25E45126EB7A0FBCA780F10543AF6CEC3A7ADE3CD4458F00

Function 00007FF64B91ADC0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF64B91AE43
VerSetConditionMask.KERNEL32 ref: 00007FF64B91AE54
VerSetConditionMask.KERNEL32 ref: 00007FF64B91AE65
VerifyVersionInfoW.KERNEL32 ref: 00007FF64B91AEA7

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
Instruction ID: d9d199bc30036272d28533cdcb09f572abfe6d00e11753bbd2162aee1af23848
Opcode Fuzzy Hash: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
Instruction Fuzzy Hash: C221387662C68086E770DF20E4583ABBBA0FB89744F001139E68987BA8EF7DC544CF40

Function 00007FF64BAA74EC Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF64BAA7535
GetLastError.KERNEL32 ref: 00007FF64BAA7543
WideCharToMultiByte.KERNEL32 ref: 00007FF64BAA7578
GetLastError.KERNEL32 ref: 00007FF64BAA7586

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: bee03ca3288017b3369f8dcb09f862a3064febdc74deef89483fb6043f1d9de6
Instruction ID: a83243c8c41843da3c41e34900e1e59741c342dd07eab67b6ec335ef87084aa8
Opcode Fuzzy Hash: bee03ca3288017b3369f8dcb09f862a3064febdc74deef89483fb6043f1d9de6
Instruction Fuzzy Hash: 5B213B76A28B8687E320AF12E44432EBBB4F78DB84F144139DB8997B64DF3DD4518B10

Function 00007FF64B932230 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF64B93227E
RegQueryValueExW.ADVAPI32 ref: 00007FF64B9322D4
RegCloseKey.ADVAPI32 ref: 00007FF64B9322EA
RegCloseKey.ADVAPI32 ref: 00007FF64B9322F9

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$CreateQueryValue
String ID:
API String ID: 2495337196-0
Opcode ID: b664341390eea32f7eaf1fb9b87576899c23662f92458e02ab7dcc225eb8d7df
Instruction ID: 90a846a5ffa1b2431a3184d19d067435c225d235f58a46d2f187dd79c8508d58
Opcode Fuzzy Hash: b664341390eea32f7eaf1fb9b87576899c23662f92458e02ab7dcc225eb8d7df
Instruction Fuzzy Hash: 4321C97251DA8186DA60AB15E49026EB7A4FBCDB80F506035FACE83B69DF3CD4548B00

Function 00007FF64B932150 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF64B93217A
RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,00007FF64B91BC9F), ref: 00007FF64B9321AB
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF64B91BC9F), ref: 00007FF64B9321BA
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF64B91BC9F), ref: 00007FF64B9321E6

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: Close$CreateDeleteValue
String ID:
API String ID: 1061628661-0
Opcode ID: 2946e63c64ed9ec3f0f0fe999219063454bcb3b8117ae03f7ba7a61e6611d512
Instruction ID: 83e6169736b164ac33a6c355e48082acde0fc7f28799377192ed8f252ece76b5
Opcode Fuzzy Hash: 2946e63c64ed9ec3f0f0fe999219063454bcb3b8117ae03f7ba7a61e6611d512
Instruction Fuzzy Hash: 1421EE2291CA8185DA60BB61E89027FB760FBCE794F005135FACEC7A7ADF6CD5449B40

Function 00007FF64BAC3594 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF64BAC35C0
GetCurrentThreadId.KERNEL32 ref: 00007FF64BAC35CE
GetCurrentProcessId.KERNEL32 ref: 00007FF64BAC35DA
QueryPerformanceCounter.KERNEL32 ref: 00007FF64BAC35EA

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c71fb8e88b71c372db582b079ead3d4d3277890d777de073fadcf7bcbc0d32b8
Instruction ID: a3f5fe37693f83970dedfeefc0e3184ed1eeab272061f50fa555ae76f483798c
Opcode Fuzzy Hash: c71fb8e88b71c372db582b079ead3d4d3277890d777de073fadcf7bcbc0d32b8
Instruction Fuzzy Hash: B7113022B18F058AEB10EF60E8542B933A4F75EB58F441E35DA6D86BA4DF78D554C340

Function 00007FF64BAE665C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF64BAE6773
GetLastError.KERNEL32 ref: 00007FF64BAE6795

Strings

U, xrefs: 00007FF64BAE671F

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 03d2d1504d171addd9b557c3c97fd95a93c136e99b01afc5296602e2ab2a4ada
Instruction ID: 3b405c7d24eb144e8a07d188c78616bc68f8d04a19d10ad489e5ce5a3c3d1194
Opcode Fuzzy Hash: 03d2d1504d171addd9b557c3c97fd95a93c136e99b01afc5296602e2ab2a4ada
Instruction Fuzzy Hash: 4541A222A2CA4186EB20BF29E4443AA77A1FB9C794F554435EE4DC7BA8EF3CD441C750

Function 00007FF64B91A6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 00007FF64B91A6DE
LCIDToLocaleName.KERNEL32 ref: 00007FF64B91A6FD

Strings

unknown, xrefs: 00007FF64B91A715

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: DefaultLanguageLocaleNameUser
String ID: unknown
API String ID: 288768712-2904991687
Opcode ID: b0b4607f95da3a468da6b761cfe9e440c128df64839d1592e9dad790b794e265
Instruction ID: 1ac44923f9faee05ca5004569e9a5a7ca6257e4f92d0ab79aaec72ef8c93d2d6
Opcode Fuzzy Hash: b0b4607f95da3a468da6b761cfe9e440c128df64839d1592e9dad790b794e265
Instruction Fuzzy Hash: 1631E832A1CA8596D620FB24E4416ABB760FBCA384F401136F6CD83A79DF3CD545CB00

Function 00007FF64BAC3DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B8C227F), ref: 00007FF64BAC3DF0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF64B8C227F), ref: 00007FF64BAC3E31

Strings

csm, xrefs: 00007FF64BAC3E1E

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 292631c76c28477b0b341e5100f2c649277cad9beabe8196f62ee79e546b0a13
Instruction ID: 8001434e8f4c27de515ebfba2c0e43f2b0a95d83659820cb67715879fed3cac4
Opcode Fuzzy Hash: 292631c76c28477b0b341e5100f2c649277cad9beabe8196f62ee79e546b0a13
Instruction Fuzzy Hash: 2B112B3261CB8582EB61AF15F540269B7E5FB88B94F584231EE8C47B68DF3CD551CB00

Function 00007FF64B92F300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetErrorInfo.OLEAUT32(?,?,?,?,?,?,00007FF64B916250), ref: 00007FF64B92F372

Strings

combase.dll, xrefs: 00007FF64B92F327
RoOriginateLanguageException, xrefs: 00007FF64B92F320

Memory Dump Source

Source File: 00000008.00000002.6508089317.00007FF64B8A1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF64B8A0000, based on PE: true

Associated: 00000008.00000002.6508023030.00007FF64B8A0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508700239.00007FF64BB0B000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508835004.00007FF64BB52000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508919626.00007FF64BB53000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6508984255.00007FF64BB68000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509047536.00007FF64BB6A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB6F000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509100571.00007FF64BB79000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000008.00000002.6509224144.00007FF64BB7C000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff64b8a0000_PcAppStore.jbxd

Similarity

API ID: ErrorInfo
String ID: RoOriginateLanguageException$combase.dll
API String ID: 3619768924-3996158991
Opcode ID: 23039f19f1820bb7f7476837f36a12bc1ccd444b90eeaabbed9ce580c32f9450
Instruction ID: abbfb25e239707d4388516f0dbcce8c02377f4a313732f309ca859ac5efe484a
Opcode Fuzzy Hash: 23039f19f1820bb7f7476837f36a12bc1ccd444b90eeaabbed9ce580c32f9450
Instruction Fuzzy Hash: 7B016162A1CA4682EF10FB24E4510AA7771FF9E384F804536E58DC3A7ADE3CD205CB40

Analysis Process: Watchdog.exePID: 8820, Parent PID: 8364COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	15

Executed Functions

Function 00007FF733C616E0 Relevance: 4.5, APIs: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF733C56FFA), ref: 00007FF733C61701
FindFirstFileExW.KERNEL32 ref: 00007FF733C61723
GetLastError.KERNEL32 ref: 00007FF733C61736

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: e02e20e4b83b26634b4baf94957bb0f30797227da8768f13bad89269cfc44f46
Instruction ID: e7ee77ad963f5bf650fdd8a1072e122ee07be0091f6ba6a1d612791ce4d0308f
Opcode Fuzzy Hash: e02e20e4b83b26634b4baf94957bb0f30797227da8768f13bad89269cfc44f46
Instruction Fuzzy Hash: 02018435608A4192E7B06B21E404329A360FF44BB6F584730DBBD17BD4DF3DD0458610

Function 00007FF733C5DBA0 Relevance: 3.8, APIs: 3, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF733C5DBEF
CloseHandle.KERNEL32 ref: 00007FF733C5DC1C

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7ff172f853f716cf9d1d95beeae36b4e8047d7bdc4e9e7ba24e55602a09b8d48
Instruction ID: cf3557ac7d609d3941fbcfcc4a130db34bf3449a2eeb28b93a8f1e801f810b19
Opcode Fuzzy Hash: 7ff172f853f716cf9d1d95beeae36b4e8047d7bdc4e9e7ba24e55602a09b8d48
Instruction Fuzzy Hash: 5511336591C682A1FBB0BB22E45537AE3A0FFC4745F805132D98E566E9DE2CE508A710

Function 00007FF733C6EEA4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,00007FF733C6F1DE), ref: 00007FF733C6F020
GetProcAddress.KERNEL32(?,00000000,00007FF733C6F1DE), ref: 00007FF733C6F02C

Strings

ext-ms-, xrefs: 00007FF733C6EF7D
api-ms-, xrefs: 00007FF733C6EF6A

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c185431dbb19fcf82ad9b5b31b2ce025036c609ab17a4281bf9476a3cdcb7b35
Instruction ID: 9c82695d04420da9333e4ab6b9de954179b730fefe368ae1c846e82f3b3ebf7c
Opcode Fuzzy Hash: c185431dbb19fcf82ad9b5b31b2ce025036c609ab17a4281bf9476a3cdcb7b35
Instruction Fuzzy Hash: 11413631B19A1262FBB6EB269D04575A384BF45BD0F884236DD0DB73D0EE3CE405A320

Function 00007FF733C5E2D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00007FF733C5E303
CommandLineToArgvW.SHELL32 ref: 00007FF733C5E314

Strings

guid, xrefs: 00007FF733C5E49B
rid, xrefs: 00007FF733C5E52D
ver, xrefs: 00007FF733C5E4E4

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CommandLine$Argv
String ID: guid$rid$ver
API String ID: 1106129467-406373251
Opcode ID: 3ab06b3f2be436757fc9abc811d322d12142cd6a00f6de1983ba124b4525124c
Instruction ID: 161f1e1c01b9d1f77b0fb206e4a4d3bc59f592951a9589d9edda00c64a637ab6
Opcode Fuzzy Hash: 3ab06b3f2be436757fc9abc811d322d12142cd6a00f6de1983ba124b4525124c
Instruction Fuzzy Hash: F091727261E981A1EAB1FB15E8412FEE360FBD5340FC05132E68D93AEADE2CD544DB10

Function 00007FF733C60DE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF733C5D370: GetModuleFileNameW.KERNEL32 ref: 00007FF733C5D3A3

SleepEx.KERNEL32 ref: 00007FF733C61047

Strings

.dmp, xrefs: 00007FF733C60FB3
\Errors, xrefs: 00007FF733C60E3F
pcapp.store, xrefs: 00007FF733C60E03

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: FileModuleNameSleep
String ID: .dmp$\Errors$pcapp.store
API String ID: 4084727719-915841659
Opcode ID: 34164a50329504c101d40668c8c4b26a2f807f33b371eee3f07fa31bbf95ecf5
Instruction ID: 540ad0071afc68c476192f76287b6f19c12200e9f2438f0f0154a51cf7d7031f
Opcode Fuzzy Hash: 34164a50329504c101d40668c8c4b26a2f807f33b371eee3f07fa31bbf95ecf5
Instruction Fuzzy Hash: AD61F37254DAC6A0EAB0FB11E4512FEE360EBD5340FC05532E68D63AEADE2CD549DB10

Function 00007FF733C6B8AC Relevance: 6.1, APIs: 4, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 00007FF733C6B918
GetLastError.KERNEL32 ref: 00007FF733C6B926
CloseHandle.KERNEL32 ref: 00007FF733C6B93C
FreeLibrary.KERNEL32 ref: 00007FF733C6B94B

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread
String ID:
API String ID: 3065451008-0
Opcode ID: c41850e104b0051c50784e11e98d8d5637d48d98f0395a28d3139850bd2f79f4
Instruction ID: a9a248674a6d921d701342c3d7a084c4e40f54d8fa28ca8be2419561aca56b52
Opcode Fuzzy Hash: c41850e104b0051c50784e11e98d8d5637d48d98f0395a28d3139850bd2f79f4
Instruction Fuzzy Hash: E8214125A09B4295EEA5FF62A410179E3A0FF88B80F884535EE4D637E5DE3CE400A720

Function 00007FF733C5E850 Relevance: 6.1, APIs: 4, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF733C5E8B0
RegQueryValueExW.KERNEL32 ref: 00007FF733C5E910
RegCloseKey.ADVAPI32 ref: 00007FF733C5E926
RegCloseKey.ADVAPI32 ref: 00007FF733C5E935

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Close$CreateQueryValue
String ID:
API String ID: 2495337196-0
Opcode ID: 17b25bd4390967a9587d4a92535a0f257787871192029a1f274db37254ea4fe6
Instruction ID: 55113b8e605b8ce4b5d0850023170e504e974d7c07d824529d2bd666e3e8e553
Opcode Fuzzy Hash: 17b25bd4390967a9587d4a92535a0f257787871192029a1f274db37254ea4fe6
Instruction Fuzzy Hash: 47210C7651CA8196E7A0AB12E4402AAF3A4FBC8791F901435EACE53B69CF7CD0549B10

Function 00007FF733C5E960 Relevance: 4.6, APIs: 3, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyW.ADVAPI32 ref: 00007FF733C5E9D1
RegQueryValueExW.KERNEL32 ref: 00007FF733C5EA34
RegCloseKey.KERNEL32 ref: 00007FF733C5EA4E

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CloseCreateQueryValue
String ID:
API String ID: 4083198587-0
Opcode ID: ad1ada592d427fa2048b348dcfbe489511d96a446958a8376f5abf4de5c1af61
Instruction ID: e114b64dba67f06b27527f9dd2c295de42fe1dc10ea080d3d2a86515bee26d85
Opcode Fuzzy Hash: ad1ada592d427fa2048b348dcfbe489511d96a446958a8376f5abf4de5c1af61
Instruction Fuzzy Hash: 12310E72618A8596E7A0EB21E4513ABF361FBC4780F804132EACE53BA9DF3CD4049B50

Function 00007FF733C71504 Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF733C6C516), ref: 00007FF733C71518
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF733C6C516), ref: 00007FF733C71582

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 28f9276106675523283c812fbedf3e64e62ab084bec685b1639a7ce59819b0a3
Instruction ID: 51d5b9e13e3949480d2aaf84c1e68a0f26262ecde1c98e7abd9055ea4789bd82
Opcode Fuzzy Hash: 28f9276106675523283c812fbedf3e64e62ab084bec685b1639a7ce59819b0a3
Instruction Fuzzy Hash: A701A511E0875555EAB4BB126414029A360AB54FE1B8C4634DF6F237C5DE2CE4429360

Function 00007FF733C6B748 Relevance: 3.0, APIs: 2, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF733C6D474: GetLastError.KERNEL32 ref: 00007FF733C6D483
Part of subcall function 00007FF733C6D474: FlsGetValue.KERNEL32 ref: 00007FF733C6D498
Part of subcall function 00007FF733C6D474: SetLastError.KERNEL32 ref: 00007FF733C6D523

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF733C60B5F), ref: 00007FF733C6B782
ExitThread.KERNEL32 ref: 00007FF733C6B78A

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ErrorLast$ExitThreadValue
String ID:
API String ID: 10640732-0
Opcode ID: 90fdddd3eb205539202c4318c00bea3395450c08f9a506176d645988f686903c
Instruction ID: 0eb0177853d43b2389b74ffcb76ec2ff926ee5ee855ab1d3b55deae714e2c7d8
Opcode Fuzzy Hash: 90fdddd3eb205539202c4318c00bea3395450c08f9a506176d645988f686903c
Instruction Fuzzy Hash: CF01B115E4D642A2EFB8BBB2945517C9260AF15B81F880530DD0D673E2DF2CF800E330

Function 00007FF733C610B0 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF733C5E2D0: GetCommandLineW.KERNEL32 ref: 00007FF733C5E303
Part of subcall function 00007FF733C5E2D0: CommandLineToArgvW.SHELL32 ref: 00007FF733C5E314

SleepEx.KERNEL32 ref: 00007FF733C6117C

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CommandLine$ArgvSleep
String ID:
API String ID: 138401787-0
Opcode ID: efc16b36b096ab38884258b42e855036f3c903c840d3c5b9257e4f5e7d884684
Instruction ID: e9041b2a9763b6f5dc18ed23273e1d81b476704126e7a64d7de7fb7521e38b56
Opcode Fuzzy Hash: efc16b36b096ab38884258b42e855036f3c903c840d3c5b9257e4f5e7d884684
Instruction Fuzzy Hash: 8521D16262C946A1EAB0FB11E4510FAA724FBD4344FD05132F28E525EADF2CD649D760

Function 00007FF733C5D480 Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF733C5D4E7

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: bd96bbac574e02d815f024f9da997c6aa16a9fbb067187f294747842f3599125
Instruction ID: 9af6caeadfff95c6dd6752644d9a40e20c8cef07cb93502be74dd0b9d77153c1
Opcode Fuzzy Hash: bd96bbac574e02d815f024f9da997c6aa16a9fbb067187f294747842f3599125
Instruction Fuzzy Hash: 69113376629A8196E7A0EB25F49536AB364F7C5340FC05136EA8E43B99DF3CD0059F10

Function 00007FF733C616C0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,?,?,?,00007FF733C57026,?,?,?,?,00007FF733C56FFA,?,?,?,?,00007FF733C57F67), ref: 00007FF733C616CA

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 6633c3bcbba3947fc1ff88d8d51966f5783bac20f3982bfd658da65195a1ac88
Instruction ID: cc001b92f1c96e9e205d313ed4222298cd8c2153270e56fa848a1db6fb1e0233
Opcode Fuzzy Hash: 6633c3bcbba3947fc1ff88d8d51966f5783bac20f3982bfd658da65195a1ac88
Instruction Fuzzy Hash: 71C01228E18103A6F9B83372084A0308190AF10332FDC0730D23D21AD0AE6DA4562A21

Function 00007FF733C616A0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,?,00007FF733C5B9BE), ref: 00007FF733C616A4

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 45b1598d97b18590ee1f375a1dc0b7122017cf018a2283715a306612294b10c7
Instruction ID: b51c55759b7fec3994978a651aa0b4dadbda7fa505764462a8247ef35ddb35e2
Opcode Fuzzy Hash: 45b1598d97b18590ee1f375a1dc0b7122017cf018a2283715a306612294b10c7
Instruction Fuzzy Hash: C2C04C19F19502E6E7A83B735C821655290AB44752FD80570C50D90390DD6D91E76621

Function 00007FF733C61D00 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00007FF733C60C85), ref: 00007FF733C61D07

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e59d26789168c431688b0075b1b8ca6d55948675341b6ac14088dc12283067ef
Instruction ID: 4e2cfeb7f7f8d6bacbe237d4a327290d0461ff050841f07df0e702377938b336
Opcode Fuzzy Hash: e59d26789168c431688b0075b1b8ca6d55948675341b6ac14088dc12283067ef
Instruction Fuzzy Hash: ADB09B5AF65401D1AB046736DC4352812506755B0BFD05530C50FD1250DD1ED19D4700

Non-executed Functions

Function 00007FF733C5ED50 Relevance: 47.7, APIs: 24, Strings: 3, Instructions: 447fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF733C5F058
GetFileSize.KERNEL32 ref: 00007FF733C5F0AF
CloseHandle.KERNEL32 ref: 00007FF733C5F0C5
CloseHandle.KERNEL32 ref: 00007FF733C5F136

Strings

/uploader.php?src=crash_dump&guid=%ws&version=%ws&t=%ws&f=%ws, xrefs: 00007FF733C5EEB1
WinHTTP 1.0, xrefs: 00007FF733C5F255
POST, xrefs: 00007FF733C5F3E3

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CloseFileHandle$CreateSize
String ID: /uploader.php?src=crash_dump&guid=%ws&version=%ws&t=%ws&f=%ws$POST$WinHTTP 1.0
API String ID: 4148174661-2094466245
Opcode ID: d66bd778d5971530c4d5da606024a718cc853c75d13cdbc55e7725838a953cf2
Instruction ID: ebcc274e1b46a245b5524d3d97c8df51b15859b8ec11aaa6a9e96d9c1bd4484a
Opcode Fuzzy Hash: d66bd778d5971530c4d5da606024a718cc853c75d13cdbc55e7725838a953cf2
Instruction Fuzzy Hash: 5B32D67264DAC2A5E6B0EB11E4903EAB360FBC5751F901132DA8D92BE9DF3DD4449B20

Function 00007FF733C61754 Relevance: 25.7, APIs: 17, Instructions: 229fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF733C61801
GetLastError.KERNEL32 ref: 00007FF733C6180B
FindFirstFileW.KERNEL32 ref: 00007FF733C61822
GetLastError.KERNEL32 ref: 00007FF733C6182E
FindClose.KERNEL32 ref: 00007FF733C6183C
CloseHandle.KERNEL32 ref: 00007FF733C618E5
CloseHandle.KERNEL32 ref: 00007FF733C61A58

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst
String ID:
API String ID: 2606427991-0
Opcode ID: b6ecde4f903c2883d93325be714976cdaba6638d5a70c55a607f0d5a940453cf
Instruction ID: 5758a9cb3a9afe43d81b599b971a8028094f82b80d5b006e2f924ec33aae205c
Opcode Fuzzy Hash: b6ecde4f903c2883d93325be714976cdaba6638d5a70c55a607f0d5a940453cf
Instruction Fuzzy Hash: 1091A631B18A0296F7F46B25A800679A390AF857B6F9C0730D9EE677D4DF3CE405A720

Function 00007FF733C62FDC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF733C62FF8
RtlCaptureContext.KERNEL32 ref: 00007FF733C63025
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF733C6303F
RtlVirtualUnwind.KERNEL32 ref: 00007FF733C63080
IsDebuggerPresent.KERNEL32 ref: 00007FF733C630D4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF733C630F1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF733C630FC

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: adb06ce9056d2fa316cb4cefb88309d9df19e0785e351ef7a27dbbc2f3529d70
Instruction ID: 4f73e3053978be8f47cc97ffcd558f651787d898138b7ccc9dc54ab312aff7ed
Opcode Fuzzy Hash: adb06ce9056d2fa316cb4cefb88309d9df19e0785e351ef7a27dbbc2f3529d70
Instruction Fuzzy Hash: DD315276609B819AEBB0AF60E8403EDB364FB84705F844439DA4E57B94DF3DD548D720

Function 00007FF733C67EA8 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF733C67F21
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF733C67F39
RtlVirtualUnwind.KERNEL32 ref: 00007FF733C67F74
IsDebuggerPresent.KERNEL32 ref: 00007FF733C67FAD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF733C67FB7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF733C67FC2

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ca1ea65e0aa9df2e334f5caa7b5a0b7e61ba4497c43f70bdc7606808fac1e5f5
Instruction ID: 3ea9f6c621c504bfafea4d2700f971ff096492051cf485e9432947823e6c5690
Opcode Fuzzy Hash: ca1ea65e0aa9df2e334f5caa7b5a0b7e61ba4497c43f70bdc7606808fac1e5f5
Instruction Fuzzy Hash: AF31B236608B819ADBB0DF25E8402AEB3A4FB88754F940135EE9D53B98DF3CD555CB10

Function 00007FF733C70330 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF733C70486

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 48bf857745ad3340444eaa65f69a2c85be334b34f5db06f4dd54ac080bcff7b2
Instruction ID: 06e5bdea225709d78ed850d1087d3f23ead6b592602ac49c85a808407c280d1d
Opcode Fuzzy Hash: 48bf857745ad3340444eaa65f69a2c85be334b34f5db06f4dd54ac080bcff7b2
Instruction Fuzzy Hash: 4BB1D462B186A255EAF0FB21D4102B9E3A0FB84BE5F845131EE5D67BC5DE3CE441E320

Function 00007FF733C61448 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,?,00007FF733C5634A), ref: 00007FF733C6146E
FormatMessageA.KERNEL32 ref: 00007FF733C614A1

Strings

!x-sys-default-locale, xrefs: 00007FF733C61461

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: c00fe59d010b592f34e97a7aa47030643ae95c4475d4667763cfb222f8a0884b
Instruction ID: e7f3c8165008f1aadb43bd1dae64c5dce007aaf3a9e5c49a10b6c127bddb21bd
Opcode Fuzzy Hash: c00fe59d010b592f34e97a7aa47030643ae95c4475d4667763cfb222f8a0884b
Instruction Fuzzy Hash: B601C072B0878697E7A19B22B400B7AA7A1FB8478AF884035DA8D57BC4CF3CD505D710

Function 00007FF733C767D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a6b6575e2cc0ac60b452e4a2ee9eba7ff89086e9f9accccabc269ea24c7a1f
Instruction ID: cdb055fc5d4ca90fb0473651a555810fce18a9348a129b06131060063a3142d7
Opcode Fuzzy Hash: d9a6b6575e2cc0ac60b452e4a2ee9eba7ff89086e9f9accccabc269ea24c7a1f
Instruction Fuzzy Hash: DBF068717192559ADBE4AF29B443629B7D0F708380F90C079D58D87F44D63C9560AF14

Function 00007FF733C61E18 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00007FF733C61F86
GetSystemTimePreciseAsFileTime, xrefs: 00007FF733C61FA6
GetTempPath2W, xrefs: 00007FF733C61FBD
GetCurrentPackageId, xrefs: 00007FF733C61F96

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 3d15b3eb9c653fb8bf89469f404861b15e1afa8f9eef01833a572815d434d3a0
Instruction ID: e9a95317ae6f3b7070b461ed5ace3bd32d69b6efc349356c2c2c8564b018401f
Opcode Fuzzy Hash: 3d15b3eb9c653fb8bf89469f404861b15e1afa8f9eef01833a572815d434d3a0
Instruction Fuzzy Hash: 1641B0A2E04B46A5FB60EB65E8441FDA360BF447A5F944331DE6C27AE5DF3CE1819310

Function 00007FF733C61F38 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF733C63468: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF733C5BDAF), ref: 00007FF733C634B8
Part of subcall function 00007FF733C63468: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF733C5BDAF), ref: 00007FF733C634F9

GetModuleHandleW.KERNEL32 ref: 00007FF733C61F8D
GetProcAddress.KERNEL32 ref: 00007FF733C61FA0
GetProcAddress.KERNEL32 ref: 00007FF733C61FB7
GetProcAddress.KERNEL32 ref: 00007FF733C61FCE

Strings

kernel32.dll, xrefs: 00007FF733C61F86
GetSystemTimePreciseAsFileTime, xrefs: 00007FF733C61FA6
GetTempPath2W, xrefs: 00007FF733C61FBD
GetCurrentPackageId, xrefs: 00007FF733C61F96

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: AddressProc$ExceptionFileHandleHeaderModuleRaise
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 1039895991-1247241052
Opcode ID: aad61275c4aaed5e5a771c555530a4604ff018f85168bf9ab42cd60621da80d4
Instruction ID: 19108c66efc4854be13c56976f1954bd68624465b642ff395ea4f747176215d6
Opcode Fuzzy Hash: aad61275c4aaed5e5a771c555530a4604ff018f85168bf9ab42cd60621da80d4
Instruction Fuzzy Hash: DA115A65A08B4BB2EA60BB51E8444B9A3A0FF44745FC04031C94C277A0DF3CE155D360

Function 00007FF733C61ADC Relevance: 13.7, APIs: 9, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF733C61A84: CreateFileW.KERNEL32 ref: 00007FF733C61AB7
Part of subcall function 00007FF733C61A84: GetLastError.KERNEL32 ref: 00007FF733C61AC6

SetFileInformationByHandle.KERNEL32 ref: 00007FF733C61B46
CloseHandle.KERNEL32 ref: 00007FF733C61B98
GetLastError.KERNEL32 ref: 00007FF733C61BCC
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF733C61C18
GetLastError.KERNEL32 ref: 00007FF733C61C26
CloseHandle.KERNEL32 ref: 00007FF733C61C3C
SetFileInformationByHandle.KERNEL32 ref: 00007FF733C61C68
SetFileInformationByHandle.KERNEL32 ref: 00007FF733C61C9C
GetLastError.KERNEL32 ref: 00007FF733C61CBE

Part of subcall function 00007FF733C6B9C4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF733C67DEE,?,?,?,00007FF733C68096), ref: 00007FF733C6B9EA

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Handle$File$ErrorInformationLast$Close$CreateFeaturePresentProcessor
String ID:
API String ID: 3900632423-0
Opcode ID: 824f1bed34943def979c0d0214c01812a96222b04afe7db87c2e753b0ce8e6fd
Instruction ID: d41f9f485c6727cebd1b3bac209595e68bced17ea6c59605762bfd039df7aa47
Opcode Fuzzy Hash: 824f1bed34943def979c0d0214c01812a96222b04afe7db87c2e753b0ce8e6fd
Instruction Fuzzy Hash: 0151E771F08242A9F7B0ABB598001BC7BA0AF44799F9C0239CD5E77BD4DF29E001A320

Function 00007FF733C6797C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF733C67C2E,?,?,?,00007FF733C6787C,?,?,?,00007FF733C641D5), ref: 00007FF733C67A01
GetLastError.KERNEL32(?,?,?,00007FF733C67C2E,?,?,?,00007FF733C6787C,?,?,?,00007FF733C641D5), ref: 00007FF733C67A0F
LoadLibraryExW.KERNEL32(?,?,?,00007FF733C67C2E,?,?,?,00007FF733C6787C,?,?,?,00007FF733C641D5), ref: 00007FF733C67A39
FreeLibrary.KERNEL32(?,?,?,00007FF733C67C2E,?,?,?,00007FF733C6787C,?,?,?,00007FF733C641D5), ref: 00007FF733C67AA7
GetProcAddress.KERNEL32(?,?,?,00007FF733C67C2E,?,?,?,00007FF733C6787C,?,?,?,00007FF733C641D5), ref: 00007FF733C67AB3

Strings

api-ms-, xrefs: 00007FF733C67A21

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 8cdb4187fcaf004885bb0e745a66ecdd46c3b050bffe59f58c31e6f610cb56a3
Instruction ID: c153d5b166d2e789a169c469334e8e1c2561892bb008b45baeaa9538300480fa
Opcode Fuzzy Hash: 8cdb4187fcaf004885bb0e745a66ecdd46c3b050bffe59f58c31e6f610cb56a3
Instruction Fuzzy Hash: 5C310721B1A642A5EEB2BB029800675A3D8FF44B60F9D1936EE1D673D1EF3DE5409320

Function 00007FF733C6D474 Relevance: 10.6, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF733C6D483
FlsGetValue.KERNEL32 ref: 00007FF733C6D498
FlsSetValue.KERNEL32 ref: 00007FF733C6D4B9
FlsSetValue.KERNEL32 ref: 00007FF733C6D4E6
FlsSetValue.KERNEL32 ref: 00007FF733C6D4F7
FlsSetValue.KERNEL32 ref: 00007FF733C6D508
SetLastError.KERNEL32 ref: 00007FF733C6D523

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f515d9795231e408bbb0356a4991ab6e25ae0e160ff9a246b8f1d58843594bfd
Instruction ID: 20e99a4cd38775c5fe431140cc10cb157e5d93e5f527ee6a05ff7c45b13a9853
Opcode Fuzzy Hash: f515d9795231e408bbb0356a4991ab6e25ae0e160ff9a246b8f1d58843594bfd
Instruction Fuzzy Hash: A8215E24A0C24262FAF47761A569139D2915F487F4F9C1738E92E36AD6DE2DB841A320

Function 00007FF733C76968 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF733C76999
GetLastError.KERNEL32 ref: 00007FF733C769A5
CloseHandle.KERNEL32 ref: 00007FF733C769BD
CreateFileW.KERNEL32 ref: 00007FF733C769E8
WriteConsoleW.KERNEL32 ref: 00007FF733C76A07

Strings

CONOUT$, xrefs: 00007FF733C769C9

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 67853ad06372b78b906bdc1da9b46fb4dda85c41ca54111b063b4663a2b5b867
Instruction ID: 5ac5c12955d1d872a773f69e12f2de6acd901238481d2f6066c614b5a485948b
Opcode Fuzzy Hash: 67853ad06372b78b906bdc1da9b46fb4dda85c41ca54111b063b4663a2b5b867
Instruction Fuzzy Hash: 4911E921718A418AE7A0AB12E844369F3A0FB48FE5F844234DD5E57BD4DF3CD9148710

Function 00007FF733C6D5EC Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0000B26730E074E2,00007FF733C6AE6D,?,?,?,?,00007FF733C701EA,?,?,00000000,00007FF733C6BC1F,?,?,?), ref: 00007FF733C6D5FB
FlsSetValue.KERNEL32(?,?,0000B26730E074E2,00007FF733C6AE6D,?,?,?,?,00007FF733C701EA,?,?,00000000,00007FF733C6BC1F,?,?,?), ref: 00007FF733C6D631
FlsSetValue.KERNEL32(?,?,0000B26730E074E2,00007FF733C6AE6D,?,?,?,?,00007FF733C701EA,?,?,00000000,00007FF733C6BC1F,?,?,?), ref: 00007FF733C6D65E
FlsSetValue.KERNEL32(?,?,0000B26730E074E2,00007FF733C6AE6D,?,?,?,?,00007FF733C701EA,?,?,00000000,00007FF733C6BC1F,?,?,?), ref: 00007FF733C6D66F
FlsSetValue.KERNEL32(?,?,0000B26730E074E2,00007FF733C6AE6D,?,?,?,?,00007FF733C701EA,?,?,00000000,00007FF733C6BC1F,?,?,?), ref: 00007FF733C6D680
SetLastError.KERNEL32(?,?,0000B26730E074E2,00007FF733C6AE6D,?,?,?,?,00007FF733C701EA,?,?,00000000,00007FF733C6BC1F,?,?,?), ref: 00007FF733C6D69B

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: d0c03b59b6ac36dbbc30015e82dff35b2a931ed0503b7f4a7d1536ea9650f947
Instruction ID: 50b0b95f2ea8fdc4e9531bb28f84a5b02b0e44780600e87146a59abebfb44310
Opcode Fuzzy Hash: d0c03b59b6ac36dbbc30015e82dff35b2a931ed0503b7f4a7d1536ea9650f947
Instruction Fuzzy Hash: BA118E24A0C24262FAF4B761A569039D2925F487B4F881B35E82E366D6DE2DF4426720

Function 00007FF733C6B4A4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 00007FF733C6B4F9
GetLastError.KERNEL32 ref: 00007FF733C6B503

Part of subcall function 00007FF733C6B3E0: GetCurrentDirectoryW.KERNEL32(?,?,?,00007FF733C6B54E), ref: 00007FF733C6B3F9
Part of subcall function 00007FF733C6B3E0: GetLastError.KERNEL32(?,?,?,00007FF733C6B54E), ref: 00007FF733C6B405

SetEnvironmentVariableW.KERNEL32 ref: 00007FF733C6B5AA
GetLastError.KERNEL32 ref: 00007FF733C6B5B4

Strings

:, xrefs: 00007FF733C6B5A2

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory$EnvironmentVariable
String ID: :
API String ID: 2281059536-336475711
Opcode ID: 8754c3b1114c533f0c2d74ef6a626152b899a1c72e305dee7d0670597648467f
Instruction ID: f88271b30d0f04794893f8ab40fe0dd0539eee48a0dedee8aa5db7ba1dab94e6
Opcode Fuzzy Hash: 8754c3b1114c533f0c2d74ef6a626152b899a1c72e305dee7d0670597648467f
Instruction Fuzzy Hash: 63416266A0C781A5EBB1BB61A4502BEF7A4FF84790FC80135EA8D537D5DF2CE441A720

Function 00007FF733C6C080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF733C6C0A5
GetProcAddress.KERNEL32 ref: 00007FF733C6C0BB
FreeLibrary.KERNEL32 ref: 00007FF733C6C0E2

Strings

mscoree.dll, xrefs: 00007FF733C6C09C
CorExitProcess, xrefs: 00007FF733C6C0B4

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f066f9fa8e2b64056c5816ad047118f8bc3c3deb3e3e559271ce8fa1bff5f537
Instruction ID: 916b261a4142f384d8f745b8b97d999e172f1b13b827bd2fcdec9c191df053fa
Opcode Fuzzy Hash: f066f9fa8e2b64056c5816ad047118f8bc3c3deb3e3e559271ce8fa1bff5f537
Instruction Fuzzy Hash: 29F0FC65718B0291FB706B10E454339D360BF497A2FD44235CD6D552F4CF2DD404D320

Function 00007FF733C6200C Relevance: 7.6, APIs: 5, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF733C6205D
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF733C61D52,?,?,?,00007FF733C606DB), ref: 00007FF733C6207C
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF733C61D52,?,?,?,00007FF733C606DB), ref: 00007FF733C6209E
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF733C61D52,?,?,?,00007FF733C606DB), ref: 00007FF733C620DF
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF733C61D52,?,?,?,00007FF733C606DB), ref: 00007FF733C620F7

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 9f859319b3b72455038857b3948c16ccaf1e950f12b3988ac996b3ef0a449c94
Instruction ID: f76c5f334ea9bb5fd330f7379f8bdbce8144ea9a895a50b19ab81be293992bba
Opcode Fuzzy Hash: 9f859319b3b72455038857b3948c16ccaf1e950f12b3988ac996b3ef0a449c94
Instruction Fuzzy Hash: 39414E32A0CA42E6EBB4AF10D440279B360FB04745F984031DB4E626D4DF3EED91EB11

Function 00007FF733C6D6B4 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF733C67E37,?,?,00000000,00007FF733C680D2,?,?,?,?,?,00007FF733C6805E), ref: 00007FF733C6D6D3
FlsSetValue.KERNEL32(?,?,?,00007FF733C67E37,?,?,00000000,00007FF733C680D2,?,?,?,?,?,00007FF733C6805E), ref: 00007FF733C6D6F2
FlsSetValue.KERNEL32(?,?,?,00007FF733C67E37,?,?,00000000,00007FF733C680D2,?,?,?,?,?,00007FF733C6805E), ref: 00007FF733C6D71A
FlsSetValue.KERNEL32(?,?,?,00007FF733C67E37,?,?,00000000,00007FF733C680D2,?,?,?,?,?,00007FF733C6805E), ref: 00007FF733C6D72B
FlsSetValue.KERNEL32(?,?,?,00007FF733C67E37,?,?,00000000,00007FF733C680D2,?,?,?,?,?,00007FF733C6805E), ref: 00007FF733C6D73C

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a8c6d510351c4b95d6c9f76d28b47f3ce8af301c86c632fa5a1562bfd9ad1745
Instruction ID: bb3508b4f6cb68f329c478b2f9f1cd47223754a4d3edac955fd513166d7f8da2
Opcode Fuzzy Hash: a8c6d510351c4b95d6c9f76d28b47f3ce8af301c86c632fa5a1562bfd9ad1745
Instruction Fuzzy Hash: F7117F20A0C24322FAF87721A565179D1925F443F0EDC5735E83E366DADE2DF842A321

Function 00007FF733C6D548 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF733C6D559
FlsSetValue.KERNEL32 ref: 00007FF733C6D578
FlsSetValue.KERNEL32 ref: 00007FF733C6D5A0
FlsSetValue.KERNEL32 ref: 00007FF733C6D5B1
FlsSetValue.KERNEL32 ref: 00007FF733C6D5C2

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 929bfb46468997a7cce17995744891d6091495042dc8cc61d415b9c1b0c17444
Instruction ID: 51a9e2b027e3baa8b1be80d1d53f3a7a87758a7f7f0c3352cc21d962232491d6
Opcode Fuzzy Hash: 929bfb46468997a7cce17995744891d6091495042dc8cc61d415b9c1b0c17444
Instruction Fuzzy Hash: 4D111C50A0C20722F9F8B7615475079D1915F48374E9C1739E93E7AAD2DE2DB842B730

Function 00007FF733C62180 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF733C59BD0: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF733C59BF0

GetLastError.KERNEL32 ref: 00007FF733C621E1
IsDebuggerPresent.KERNEL32 ref: 00007FF733C621F9
OutputDebugStringW.KERNEL32 ref: 00007FF733C6220A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF733C62203

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 1ec5bcb918012ac8b7319f3a40652a31004f18662585170a9d419b9ae026aae0
Instruction ID: 3d651dd9aea4afbe4d7b7c4194182b543b30e465d56ed2921bb226edc6da1438
Opcode Fuzzy Hash: 1ec5bcb918012ac8b7319f3a40652a31004f18662585170a9d419b9ae026aae0
Instruction Fuzzy Hash: 10114F32A14B42A6F7A4AB22D554379B3A4FF44355F844135CA4D52A90EF3DF474D720

Function 00007FF733C741F0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF733C7426F
WriteFile.KERNEL32 ref: 00007FF733C74537
WriteFile.KERNEL32 ref: 00007FF733C7457D
GetLastError.KERNEL32 ref: 00007FF733C74633

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1309bd19cc395fbbde763f73ab8c973ae47e3b2fc9efad1be869f737f2af7d77
Instruction ID: 6163cfa6e3d792b499a6cf6e66549d8a25ea880826838968505238088de684e1
Opcode Fuzzy Hash: 1309bd19cc395fbbde763f73ab8c973ae47e3b2fc9efad1be869f737f2af7d77
Instruction Fuzzy Hash: F2D12332B08A809DE7A1DF65D4402ECB7B5FB44B98B944236CE9DA7BC9DE38D446D310

Function 00007FF733C74B18 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF733C74B03,00000000), ref: 00007FF733C74C34
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF733C74B03,00000000), ref: 00007FF733C74CBF

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c14f2174c2104d8536fdc1901a268c98a6676dd90a2cb401af9a2391e52543d3
Instruction ID: ad7144872374dd3b3ee753abf516ec54fb42936a4990ad0a1f9dbce94bff70ac
Opcode Fuzzy Hash: c14f2174c2104d8536fdc1901a268c98a6676dd90a2cb401af9a2391e52543d3
Instruction Fuzzy Hash: 5E91D422B18651A9F7B0AF6594402FDBBA4BB00B8AF944139DE8E776D4CF3CD481D720

Function 00007FF733C615D4 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF733C6161D
GetLastError.KERNEL32 ref: 00007FF733C6162B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF733C52827), ref: 00007FF733C61660
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF733C52827), ref: 00007FF733C6166E

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 9341f2710dc757ff7bc42cdcd365ac290861a622a879979225c5c00edac8c97f
Instruction ID: eca7766a665a49990a7b6bbb2de3259e1744351f50bf100ceed25bf5e4e0104e
Opcode Fuzzy Hash: 9341f2710dc757ff7bc42cdcd365ac290861a622a879979225c5c00edac8c97f
Instruction Fuzzy Hash: B2215176A18B81D7E7609F21E44432EBAB4F798B95F580134DB8D67B94DF3DD4018B10

Function 00007FF733C6322C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF733C63258
GetCurrentThreadId.KERNEL32 ref: 00007FF733C63266
GetCurrentProcessId.KERNEL32 ref: 00007FF733C63272
QueryPerformanceCounter.KERNEL32 ref: 00007FF733C63282

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0752faed2c64be0a210216895c40d031dbf65d8aa9a7dec5ed73cd956d765bd3
Instruction ID: 6406530dd1e7b5d322cdf60a325b1c5fd19b7abf35378ccdb25cb0375fac5bde
Opcode Fuzzy Hash: 0752faed2c64be0a210216895c40d031dbf65d8aa9a7dec5ed73cd956d765bd3
Instruction Fuzzy Hash: F3115A26B14F019AEB50EF60E8452B873A4FB18759F840E31DE2E967A4DF3CE1949350

Function 00007FF733C61534 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32 ref: 00007FF733C61554
GetLastError.KERNEL32 ref: 00007FF733C6155E
SetFileInformationByHandle.KERNEL32 ref: 00007FF733C61591
GetLastError.KERNEL32 ref: 00007FF733C6159B

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ErrorFileHandleInformationLast
String ID:
API String ID: 275135790-0
Opcode ID: 9fc74a38eef838ed1cb2bb3887b33f508be7068b0bd23077a422192673dc1a33
Instruction ID: 9753ab65ba2f8dc32530c12f3f1cf976d5dbf3248291cc56180a81acde3626d6
Opcode Fuzzy Hash: 9fc74a38eef838ed1cb2bb3887b33f508be7068b0bd23077a422192673dc1a33
Instruction Fuzzy Hash: D4F0D671E1814296FBF4BB30E4646B4EA90AF50706F980130CA4F617E4DE2DE5849720

Function 00007FF733C65C94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF733C65D04

Strings

MOC, xrefs: 00007FF733C65D18
RCC, xrefs: 00007FF733C65D20

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6c8a1ad9b2dd14a38ce59a9140fae546aa99af9281cbd4c5f54eb279d56b435b
Instruction ID: a3ac5106b6705585b374b084e7b30e598fd9d003def7a5aa609a1ed68f276e16
Opcode Fuzzy Hash: 6c8a1ad9b2dd14a38ce59a9140fae546aa99af9281cbd4c5f54eb279d56b435b
Instruction Fuzzy Hash: 2491B273A087819AE7A0EB64E8402ADB7B0FB44788F584139EB4D27796DF3CD195D700

Function 00007FF733C65A24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF733C65A83

Strings

RCC, xrefs: 00007FF733C65A9F
MOC, xrefs: 00007FF733C65A97

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 85138a45848b6e99d9d24c06b214a49be9e617f3098cb972f5730af7df222da7
Instruction ID: 4e4e2ebd8fa0fce1c7ac3b62c0e215590f564704b9cddfedc63225bb3e466578
Opcode Fuzzy Hash: 85138a45848b6e99d9d24c06b214a49be9e617f3098cb972f5730af7df222da7
Instruction Fuzzy Hash: A861A132908BC595D7B0AF15E4403AAF7A0FB89784F584225EB9D23B96DF3CE194CB10

Function 00007FF733C74888 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF733C7499F
GetLastError.KERNEL32 ref: 00007FF733C749C1

Strings

U, xrefs: 00007FF733C7494B

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 79398ed7aff2c6f21d9f14bd257babe685f64ab3a633a3e710b27d0545059d7f
Instruction ID: 109c1b99f0de38d7e402e8775987d1c753178d3360516d05c7028ba5beca8b2e
Opcode Fuzzy Hash: 79398ed7aff2c6f21d9f14bd257babe685f64ab3a633a3e710b27d0545059d7f
Instruction Fuzzy Hash: 7241C322B1CA8195DBB0EF25E8443A9A7A5FB88784F844131EE8D97BD8DF3CD541D710

Function 00007FF733C63468 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF733C5BDAF), ref: 00007FF733C634B8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF733C5BDAF), ref: 00007FF733C634F9

Strings

csm, xrefs: 00007FF733C634E6

Memory Dump Source

Source File: 00000009.00000002.6501127777.00007FF733C51000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF733C50000, based on PE: true

Associated: 00000009.00000002.6500869448.00007FF733C50000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501341324.00007FF733C7A000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501498423.00007FF733C8A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C8D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000009.00000002.6501583956.00007FF733C93000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff733c50000_Watchdog.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 5b7f0b454f80348c103df898bd0041737ab7f2dca4b57be5a72f76fce5fb0a09
Instruction ID: 8faaf94643f615e812e6a00202f1bd6421f5e77531427c374c98652d57ea21c0
Opcode Fuzzy Hash: 5b7f0b454f80348c103df898bd0041737ab7f2dca4b57be5a72f76fce5fb0a09
Instruction Fuzzy Hash: 0D116036618B4092EB629F15F440269FBE4FB88B94F584230EE8D177A8DF3DD551C700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003e.db

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003f.db

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000040.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\p[1].gif

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\Math.dll

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\NSISFastLib.dll

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\image.gif

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\inetc.dll

C:\Users\user\AppData\Local\Temp\nsa5834.tmp\nsJSON.dll

C:\Users\user\AppData\Local\Temp\nsl5824.tmp

C:\Users\user\AppData\Local\Temp\nsy2C04.tmp

C:\Users\user\AppData\Local\Temp\nsz155E.tmp\NSISFastLib.dll

Windows Analysis Report
Setup.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre